CVE-2026-14476: SSSD Path Traversal Vulnerability

CVE-2026-14476 Overview

CVE-2026-14476 is a path traversal flaw in the System Security Services Daemon (SSSD) Active Directory Group Policy Object (AD GPO) provider. The ad_gpo_extract_smb_components() function fails to sanitize .. sequences in the gPCFileSysPath LDAP attribute. An attacker with AD GPO management access can write arbitrary files outside the GPO cache directory with root privileges. On default Red Hat Enterprise Linux (RHEL) systems running SELinux in enforcing mode, the flaw enables injection of Kerberos configuration files, resulting in authentication bypass. The vulnerability is tracked under [CWE-23: Relative Path Traversal].

Critical Impact
An authenticated attacker with AD GPO management rights can escape the GPO cache directory, write files as root, and hijack Kerberos authentication on affected Linux hosts.

Affected Products

SSSD (System Security Services Daemon) AD GPO provider
Red Hat Enterprise Linux with SSSD configured for Active Directory integration
Linux distributions using SSSD with SELinux enforcing mode

Discovery Timeline

2026-07-07 - CVE CVE-2026-14476 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14476

Vulnerability Analysis

SSSD provides Linux clients with access to identity and authentication resources from Active Directory. The AD GPO provider retrieves Group Policy Objects from domain controllers over SMB. It caches policy files locally for enforcement. The ad_gpo_extract_smb_components() function parses the gPCFileSysPath LDAP attribute to determine remote GPO paths. This attribute is controlled by users with GPO management rights in Active Directory. The function does not filter .. sequences before constructing local file paths from the attribute value. As a result, attacker-supplied path components traverse outside the intended GPO cache directory.

Root Cause

The root cause is missing input sanitization in ad_gpo_extract_smb_components(). The function trusts the gPCFileSysPath LDAP value as returned by the domain controller. It concatenates path components without normalizing relative traversal sequences. SSSD runs as root to write policy files, so any file created through the traversal inherits root ownership.

Attack Vector

The attack requires an adversary with permission to create or modify GPOs in the target Active Directory domain. The attacker sets a crafted gPCFileSysPath value that includes .. segments pointing to sensitive system locations. When an SSSD-enrolled Linux client applies the malicious GPO, ad_gpo_extract_smb_components() resolves the path outside the cache directory. SSSD then writes attacker-controlled content as root. On RHEL with SELinux enforcing, the practical impact demonstrated by Red Hat is writing to Kerberos configuration paths such as /etc/krb5.conf.d/. Injected Kerberos configuration redirects authentication flows, enabling authentication bypass on the host.

No public exploit code or proof-of-concept is available at the time of publication. Technical details are described in the Red Hat CVE-2026-14476 Advisory and Red Hat Bug Report #2496581.

Detection Methods for CVE-2026-14476

Indicators of Compromise

Unexpected files under /etc/krb5.conf.d/, /etc/sssd/, or other system directories owned by root with recent modification times matching GPO refresh intervals.
SSSD log entries in /var/log/sssd/sssd_<domain>.log referencing gPCFileSysPath values containing .. sequences.
New or modified GPOs in Active Directory whose gPCFileSysPath attribute deviates from the standard \\domain\SysVol\... format.
Kerberos authentication anomalies such as unexpected KDC referrals or realm redirections on SSSD-enrolled hosts.

Detection Strategies

Audit Active Directory for recent changes to GPO gPCFileSysPath attributes using directory replication metadata or change auditing.
Monitor file integrity on SSSD-enrolled Linux hosts, focusing on /etc/krb5.conf, /etc/krb5.conf.d/, /etc/sssd/, and /etc/pam.d/.
Correlate SSSD GPO refresh events with subsequent file creation events outside /var/lib/sss/gpo_cache/.

Monitoring Recommendations

Enable SSSD debug logging at level 6 or higher during triage to capture the LDAP attribute values processed by the GPO provider.
Forward Linux audit daemon (auditd) events for writes to sensitive configuration directories to a centralized log platform.
Alert on any process running as root writing to Kerberos configuration paths outside package management operations.

How to Mitigate CVE-2026-14476

Immediate Actions Required

Apply vendor-provided SSSD updates as soon as they are released. Consult the Red Hat CVE-2026-14476 Advisory for package versions.
Restrict GPO creation and modification rights in Active Directory to a minimal set of administrators, and audit existing delegations.
Review all existing GPOs for anomalous gPCFileSysPath values and remove or remediate suspicious entries.
Verify integrity of Kerberos configuration files on all SSSD-enrolled Linux hosts.

Patch Information

Patched SSSD packages are being released by Red Hat and downstream distributions. Refer to the Red Hat CVE-2026-14476 Advisory and Red Hat Bug Report #2496581 for specific package versions and errata identifiers applicable to each supported release.

Workarounds

Disable the AD GPO provider by setting ad_gpo_access_control = disabled in /etc/sssd/sssd.conf on affected hosts until patches are applied. This removes GPO-based access enforcement but blocks the vulnerable code path.
Tighten Active Directory delegation so that only trusted administrators hold GPO edit rights on domains hosting Linux clients.
Maintain SELinux in enforcing mode, which limits some post-exploitation actions, though it does not prevent Kerberos configuration injection.

bash

# Temporary mitigation: disable GPO access control in SSSD
sudo sed -i 's/^ad_gpo_access_control.*/ad_gpo_access_control = disabled/' /etc/sssd/sssd.conf
grep -q '^ad_gpo_access_control' /etc/sssd/sssd.conf || \
  echo 'ad_gpo_access_control = disabled' | sudo tee -a /etc/sssd/sssd.conf
sudo systemctl restart sssd