Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
yast2-auth-client can let attackers run commands
published 2 months ago
Summary
The yast2-auth-client program could be tricked into executing system commands when it processes certain Active Directory information. This could allow an unauthorized user to run code on your servers. Update to the latest version (3.3.22) as soon as possible to close this risk.
What to do
- Update suse yast2-auth-client to version 3.3.22-3.15.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 12 SP5-LTSS | suse | yast2-auth-client |
< 3.3.22-3.15.1 Fix: upgrade to 3.3.22-3.15.1
|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | yast2-auth-client |
< 3.3.22-3.15.1 Fix: upgrade to 3.3.22-3.15.1
|
Original advisory text
Security update for yast2-auth-client
This update for yast2-auth-client fixes the following issue:
Update to version 3.3.22.
- CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join (AutoYaST-reachable)
(bsc#1272775).
Update to version 3.3.22.
- CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join (AutoYaST-reachable)
(bsc#1272775).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263893-1/ Vendor Advisory
- https://bugzilla.suse.com/1272775 Third Party Advisory
- https://bugzilla.suse.com/1274806 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-59681 URL
Timeline
Published31 Aug 2026
Updated10 Sep 2026
First seen10 Sep 2026
Sources
SUSE-SU-2026:3893-1 · OSV
Track software like this
Free during beta