CVE-2026-59681: yast2-auth-client Command Injection RCE

CVE-2026-59681 Overview

CVE-2026-59681 is an OS command injection vulnerability in yast2-auth-client, a YaST module used to configure authentication clients on SUSE Linux systems. The flaw resides in the Auth::AuthConf class in src/lib/auth/authconf.rb, which constructs Samba net ads join, net ads lookup -S, and net ads testjoin commands by interpolating user-controlled Active Directory (AD) configuration values into shell command strings. An attacker who controls the AD configuration values can execute arbitrary commands as root on the target host. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Successful exploitation grants arbitrary command execution as root, resulting in full compromise of the affected host.

Affected Products

yast2-auth-client (SUSE YaST authentication client module)
SUSE Linux distributions shipping the vulnerable yast2-auth-client package
Systems using YaST to join Active Directory domains via Samba net ads

Discovery Timeline

2026-09-01 - CVE-2026-59681 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-59681

Vulnerability Analysis

The Auth::AuthConf class in src/lib/auth/authconf.rb builds Samba commands by concatenating configuration values into a single command string. The assembled string is passed to Open3.popen2 and Open3.capture2, which invoke /bin/sh to interpret the command. Because Ruby routes the string through a shell when a single string argument is used, shell metacharacters embedded in the interpolated values are evaluated.

The Organizational Unit (ou), dnshostname, AD user name, and AD domain name values reach this code path without input validation or shell quoting. An attacker who supplies malicious values for any of these fields can break out of the intended command context and inject arbitrary shell commands. YaST modules typically run with root privileges during system configuration, so injected commands execute in that context.

Root Cause

The root cause is unsafe command construction combined with shell interpretation. Passing a single interpolated string to Open3.popen2 or Open3.capture2 causes Ruby to spawn /bin/sh -c <string>. Using the array form of these APIs would bypass the shell entirely and eliminate the metacharacter parsing. The absence of validation or Shellwords.escape on AD configuration fields converts trusted-looking configuration input into an injection primitive.

Attack Vector

Exploitation requires that an attacker control the AD configuration values consumed by yast2-auth-client. This is feasible when an administrator is induced to join a rogue or attacker-influenced Active Directory domain, or when configuration values are sourced from an attacker-controlled system. Once the operator triggers a join, lookup, or testjoin operation, the injected payload runs as root on the configured host. The CVSS 4.0 vector indicates network attack surface with required user interaction.

For technical specifics, see the SUSE Bug Report #1272775.

Detection Methods for CVE-2026-59681

Indicators of Compromise

Unexpected child processes spawned by yast2 or Ruby processes with /bin/sh -c command lines containing shell metacharacters such as ;, `, $(, |, or &&.
Audit records showing net ads join, net ads lookup -S, or net ads testjoin invocations with unusual arguments in the ou, dnshostname, user, or domain fields.
New root-owned files, cron entries, systemd units, or SSH keys created during or immediately after an AD join operation.

Detection Strategies

Monitor process ancestry for sh invocations parented by yast2-auth-client or Ruby interpreters running authconf.rb.
Inspect YaST and Samba logs for AD configuration values containing shell metacharacters or command separators.
Correlate AD join operations with subsequent outbound network connections, package installations, or user account changes.

Monitoring Recommendations

Enable Linux auditd rules covering execve calls originating from YaST authentication workflows and forward events to a centralized data lake.
Alert on any interactive shell or reverse shell spawned within a short window after net ads command execution.
Track modifications to /etc/samba/smb.conf, /etc/krb5.conf, and /etc/nsswitch.conf alongside YaST invocations.

How to Mitigate CVE-2026-59681

Immediate Actions Required

Apply the SUSE-provided update for yast2-auth-client as soon as it is available through the standard patch channel.
Restrict access to hosts running YaST authentication workflows to trusted administrators only.
Validate the authenticity of Active Directory domains before initiating a join operation from a SUSE host.

Patch Information

Refer to SUSE Bug Report #1272775 for the tracking record and fixed package versions. The fix replaces string-based Open3.popen2 and Open3.capture2 calls with the array form, which invokes the target binary directly and bypasses /bin/sh. Configuration values are also validated and shell-escaped before use.

Workarounds

Avoid running yast2-auth-client AD join, lookup, or testjoin operations against untrusted or externally provided AD configuration data until patched.
Configure Active Directory integration manually using realmd or vetted net ads invocations from a controlled shell, ensuring inputs are sanitized.
Limit which administrators can invoke YaST modules by restricting sudo rules and console access to the affected hosts.

bash

# Configuration example: verify installed version and update yast2-auth-client
rpm -q yast2-auth-client
sudo zypper refresh
sudo zypper update yast2-auth-client