A OS command injection vulnerability exists in the yast2-auth-client component. The flaw occurs when Active Directory configuration values—specifically the Organizational Unit, dnsHostName, AD user name, and domain name—are interpolated directly into a shell command that Samba uses to join the domain. Because these values are not validated or shell‑quoted, an attacker who can control the AD configuration can inject arbitrary arguments into the net ads join command. As a result, the attacker can execute any command as root on the host, producing full system compromise through injection of arbitrary payloads. This is a classic command injection weakness (CWE‑78).

The affected product is SUSE’s yast2-auth-client, which provides the user-facing tool for authenticating and joining Active Directory domains on SUSE Linux Enterprise systems. No specific product versions are listed in the advisory, so any deployment of yast2-auth-client that does not have the upstream patch applied is potentially vulnerable. The vulnerability relies on the presence of the AuthConf code that builds and executes domain‑join commands.

The CVSS score of 8.7 indicates a high‑severity vulnerability that grants full control over the system with relatively simple exploitation. EPSS is not available, so the exploitation probability is unknown, but the lack of mitigation in the product and the fact that an attacker needs only to supply malicious AD configuration values makes the attack path viable. The vulnerability is not yet listed in the CISA KEV catalog, but its impact and the ease of trigger suggest it should be treated as a critical security issue. The likely attack vector is an AD administrator or attacker who can write policies or scripts to set the OU and dnsHostName fields and then trigger a domain join process.