A path traversal flaw exists in SSSD’s Active Directory GPO provider. The function ad_gpo_extract_smb_components() fails to sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management permissions to write arbitrary files outside the GPO cache directory as root. On a default RHEL configuration with SELinux enforcing, the attacker can inject a malicious Kerberos configuration file that results in authentication bypass for any user subject to the compromised domain controller’s settings. This vulnerability compromises Kerberos authentication integrity.

The flaw is present in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, all of which use SSSD for Kerberos authentication and process GPOs. The issue arises whenever the SSSD AD GPO provider is enabled and the default SELinux policy is in enforcing mode.

The CVSS score of 8 indicates high severity. The EPSS score of < 1 % indicates a very low but non‑zero likelihood of exploitation. The flaw is not listed in CISA KEV. Exploitation requires an account with GPO management rights, typically restricted to administrators or compromised domain accounts. With root write access via the traversal, an attacker can alter the Kerberos configuration and achieve authentication bypass. The path traversal path is enabled by the unsanitized LDAP attribute and can be executed even under SELinux enforcing because the attacker writes as root.