Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to LDAP directory
  2. Delivery
    Locate writable subtree
  3. Exploit
    Inject malicious sudoRole object
  4. Execution
    SSSD searches full tree, loads rule
  5. Persist
    Run sudo as root on enrolled hosts
  6. Impact
    Domain-wide root compromise

Vulnerability Assessment

Weakness
CWE
CWE-1188
ASVS 5.0
V13 - Configuration Secure default settings
Exploitation Conditions

Exploitation requires two concrete conditions from the description: (1) the SSSD LDAP sudo provider is in use with the ldap_sudo_search_base option NOT explicitly configured, causing SSSD to search the entire LDAP directory tree for sudoRole objects; and (2) the attacker is an authenticated directory principal holding write access to at least one subtree of the LDAP directory, sufficient to create a sudoRole object. Limiting factors: it is not exploitable against deployments that pin ldap_sudo_search_base to a restricted OU, nor by unauthenticated users, nor by authenticated users with no directory write permissions; impact is realized when enrolled hosts perform their next sudo policy lookup.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) accurately captures a network-reachable, low-complexity attack that requires some existing privilege (PR:L) - specifically write access to a directory subtree - and yields full confidentiality, integrity, and availability impact via root sudo. The realistic severity is amplified by blast radius: a single injected object grants root across ALL SSSD-enrolled hosts, effectively a domain-wide compromise, which arguably justifies a scope change (S:C) beyond Red Hat's S:U rating. However, exploitation is gated on the attacker already holding LDAP write access to some subtree AND the target deployment leaving ldap_sudo_search_base unconfigured, so this is not a mass-internet-exploitable flaw. No EPSS score, KEV entry, or POC was provided; the absence of these signals suggests no confirmed active exploitation, but the trust-relationship nature of the bug makes it high-value for insider or post-foothold escalation. Treat as a priority patch for environments using SSSD LDAP sudo without an explicit search base.
Exploit ScenarioDerived

An authenticated directory user who has been delegated write access to a seemingly harmless subtree (for example, their own group or department OU) creates a sudoRole object granting themselves ALL=(ALL) NOPASSWD on all hosts. Because the victim organization never set ldap_sudo_search_base, every SSSD-enrolled server discovers and applies the injected rule on its next sudo lookup, and the attacker runs commands as root across the fleet. No public POC is referenced, but the attack requires only standard LDAP write operations and the built-in sudo command.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 07, 2026

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user with write access to any subtree to inject a malicious sudoRole object and gain root-level sudo on every SSSD-enrolled host. The flaw exists because, when ldap_sudo_search_base is left unset, SSSD searches the entire directory tree for sudoRole objects, trusting rules planted anywhere in the DIT. Rated CVSS 8.8 by Red Hat and reported against RHEL 6 through 10 and OpenShift Container Platform 4; no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

No vendor-released patch version was identified in the provided data - monitor the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-14474) and Bugzilla 2496556 (https://bugzilla.redhat.com/show_bug.cgi?id=2496556) for the fixed SSSD package build for your RHEL/OpenShift release and apply it once published. The most effective immediate compensating control is to explicitly set ldap_sudo_search_base in the [domain] section of sssd.conf to the specific, tightly-controlled OU where legitimate sudoRole objects live (e.g. ou=SUDOers,dc=example,dc=com), which stops SSSD from honoring rogue objects planted elsewhere; the trade-off is that any legitimately-used sudo rules outside that base will stop applying, so inventory existing sudoRole locations first. Additionally, tighten LDAP directory ACLs so ordinary authenticated users cannot create or modify objects in arbitrary subtrees, and audit the directory for unexpected sudoRole entries. Restart SSSD and clear its cache (sss_cache -E) after configuration changes.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

SSSD (System Security Services Daemon) is the identity, authentication, and access-control broker that ties Linux hosts to central directories such as LDAP, FreeIPA, and Active Directory. Its sudo provider fetches sudoRole objects from LDAP to centrally manage sudoers policy. The ldap_sudo_search_base option is meant to constrain where SSSD looks for these objects; when it is not explicitly configured, SSSD falls back to searching from the directory root, so a sudoRole placed in ANY writable branch of the tree is honored. This maps to CWE-1188 (insecure default resource initialization): the insecure default scope, not a memory-safety or parsing bug, is the root cause - the Red Hat 'Code Injection' tag refers to injecting an authorization object rather than executable code.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Network-reachable LDAP write (AV:N/AC:L), attacker needs delegated directory write privileges so PR:L not PR:N, and injected sudoRole yields full root impact (C/I/A:H); S:U kept per vendor though cross-host reach arguably warrants S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Executive ViewAI

Why It Matters

SSSD's LDAP sudo provider in RHEL 6-10 and OpenShift Container Platform 4 contains a privilege escalation vulnerability (CVE-2026-14474, CVSS 8.8) that allows LDAP directory users with write access to inject malicious sudo rules and gain root-level access across all enrolled hosts. Organizations running these platforms face complete infrastructure compromise if LDAP directory permissions and SSSD configurations are not properly controlled. No vendor patch is currently available, making configuration hardening and access controls critical.

Business Impact: High
Compensating Controls

Configure ldap_sudo_search_base parameter in SSSD to limit sudoRole object searches to specific, authorized directory subtrees rather than the entire tree. Implement strict LDAP access controls restricting write permissions on sudoRole objects to administrative accounts only. Enable LDAP audit logging for all sudoRole object creation and modification events and monitor for anomalies. Reduce LDAP administrator role membership to minimum necessary accounts and review all existing sudoRole objects for legitimacy.

Threat Intelligence Overview

EPSS Score
0.5%
Top 60% exploitable
Prevalence
High
SSSD is the default LDAP/AD identity broker across enterprise RHEL fleets
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-1188 – Initialization of a Resource with an Insecure Default

View all
CVE-2017-4971 MEDIUM
5.9
CVE-2026-66066 CRITICAL POC
9.5
CVE-2023-27524 CRITICAL POC
9.8
CVE-2022-24706 CRITICAL POC
9.8
CVE-2017-7964 CRITICAL POC
10.0
CVE-2018-8014 CRITICAL
9.8
CVE-2017-8218 CRITICAL POC
9.8
CVE-2026-28775 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-14474 ADVISORY https://vuldb.com/vuln/376627 REF https://access.redhat.com/errata/RHSA-2026:41937 REF https://access.redhat.com/errata/RHSA-2026:42122 REF https://access.redhat.com/errata/RHSA-2026:46482 REF https://access.redhat.com/errata/RHSA-2026:46990 REF https://access.redhat.com/errata/RHSA-2026:49839 REF https://access.redhat.com/errata/RHSA-2026:49840 REF https://access.redhat.com/errata/RHSA-2026:49841 REF https://access.redhat.com/errata/RHSA-2026:49842 REF https://access.redhat.com/errata/RHSA-2026:49843 REF https://access.redhat.com/errata/RHSA-2026:49844 REF https://access.redhat.com/errata/RHSA-2026:50109 REF https://access.redhat.com/errata/RHSA-2026:54187 REF https://access.redhat.com/errata/RHSA-2026:54553 REF https://access.redhat.com/errata/RHSA-2026:54581 REF https://access.redhat.com/errata/RHSA-2026:54599 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/security/cve/CVE-2026-14474 REF https://bugzilla.redhat.com/show_bug.cgi?id=2496556

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy