A path traversal flaw exists in SSSD’s Active Directory GPO provider. The function ad_gpo_extract_smb_components() fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with appropriate GPO Management authority to write files outside the GPO cache directory as root. On a default Red Hat Enterprise Linux configuration with SELinux enforcing, the attacker can inject a malicious Kerberos configuration file, which results in authentication bypass for any user subject to the compromised domain controller’s settings. The vulnerability therefore compromises the integrity of Kerberos authentication.

The vulnerability affects all Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, because these systems use SSSD for Kerberos authentication and process Active Directory GPOs.

The CVSS score of 8 indicates high severity, and the EPSS score of < 1 % denotes a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an account with Active Directory GPO management permissions; such accounts are typically held by administrators or compromised domain accounts. Using root write access via the path traversal, an attacker can alter the Kerberos configuration and achieve authentication bypass. The traversal path is enabled by an unsanitized LDAP attribute and can be executed even under SELinux enforcing because the attacker writes as root.