Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
SSSD: Privilege Escalation and Authentication Bypass
published 3 months ago
Summary
This update affects the SSSD software, which manages user authentication and access on Linux systems. If left unpatched, it could allow attackers to gain elevated privileges or bypass authentication checks, compromising system security. To stay secure, apply the latest SSSD update as soon as possible.
What to do
- Update suse sssd to version 2.5.2-150500.10.44.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | sssd |
< 2.5.2-150500.10.44.1 Fix: upgrade to 2.5.2-150500.10.44.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | sssd |
< 2.5.2-150500.10.44.1 Fix: upgrade to 2.5.2-150500.10.44.1
|
| SUSE:Linux Enterprise Micro 5.5 | suse | sssd |
< 2.5.2-150500.10.44.1 Fix: upgrade to 2.5.2-150500.10.44.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | sssd |
< 2.5.2-150500.10.44.1 Fix: upgrade to 2.5.2-150500.10.44.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | sssd |
< 2.5.2-150500.10.44.1 Fix: upgrade to 2.5.2-150500.10.44.1
|
Original advisory text
Security update for sssd
This update for sssd fixes the following issues
- CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege
escalation (bsc#1270709).
- CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
(bsc#1270708).
- CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege
escalation (bsc#1270709).
- CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
(bsc#1270708).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263195-1/ Vendor Advisory
- https://bugzilla.suse.com/1246196 Third Party Advisory
- https://bugzilla.suse.com/1270708 Third Party Advisory
- https://bugzilla.suse.com/1270709 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-14474 URL
- https://www.suse.com/security/cve/CVE-2026-14476 URL
Timeline
Published22 Jul 2026
Updated28 Jul 2026
First seen28 Jul 2026
Sources
SUSE-SU-2026:3195-1 · OSV
Track software like this
Free during beta