Description
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
Published: 2026-07-07
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SSSD’s LDAP sudo provider flaw causes the system to search the entire LDAP directory tree for sudoRole objects when the ldap_sudo_search_base option is not set. An authenticated attacker who can write to any subtree of the directory can inject a sudoRole object, granting that attacker root‑level sudo privileges on every host where SSSD is enrolled, thereby achieving full administrative control.

Affected Systems

The flaw affects all Red Hat Enterprise Linux releases from 6 to 10, including the 10.0 Extended Update Support track, as well as Red Hat OpenShift Container Platform 4. Any installation of SSSD in these environments that does not explicitly configure a sudo search base is vulnerable.

Risk and Exploitability

A CVSS score of 8.8 reflects high severity, while an EPSS score of < 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an LDAP account with write permissions; attackers who already hold such permissions can create or modify sudoRole entries, escalating privileges across all SSSD‑enabled hosts.

Generated by OpenCVE AI on August 3, 2026 at 04:57 UTC.

Remediation

Vendor Workaround

Set ldap_sudo_search_base explicitly in /etc/sssd/sssd.conf to restrict the search to the designated sudoers container: [domain/example.com] ldap_sudo_search_base = ou=sudoers,dc=example,dc=com Additionally, restrict LDAP ACLs to prevent non-admin principals from creating sudoRole objects outside the designated sudoers container.

OpenCVE Recommended Actions

  • Explicitly configure ldap_sudo_search_base in /etc/sssd/sssd.conf to restrict searches to the intended sudoers container.
  • Restrict LDAP ACLs so that only administrators can create or modify sudoRole objects outside the designated sudoers container.
  • Review LDAP directory write permissions to ensure only authorized users have the ability to add or modify sudoRole objects.

Generated by OpenCVE AI on August 3, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References

Tue, 04 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References

Tue, 04 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_e4s:9.2::baseos
cpe:/o:redhat:rhel_e4s:9.4::baseos
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
References

Tue, 28 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
References

Mon, 27 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References

Mon, 20 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
cpe:/o:redhat:enterprise_linux:9::baseos
References

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References

Wed, 08 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 07 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
Title Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-1188
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Redhat Enterprise Linux Enterprise Linux Eus Openshift Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Eus Long Life Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-04T17:22:34.101Z

Reserved: 2026-07-02T14:49:31.316Z

Link: CVE-2026-14474

cve-icon Vulnrichment

Updated: 2026-07-07T13:41:56.725Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-07T10:16:39.870

Modified: 2026-08-04T18:16:43.033

Link: CVE-2026-14474

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-07T09:00:00Z

Links: CVE-2026-14474 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T05:00:16Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default