目标达成感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%

请我们喝杯咖啡

CVE-2026-14476— Red Hat sssd 路径遍历漏洞

一分钟漏洞结论

影响对象

Red Hat Red Hat Enterprise Linux 10

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Red Hat sssd是美国Red Hat公司的一款数据库系统软件。 Red Hat sssd存在路径遍历漏洞，该漏洞源于SSSD的AD GPO提供程序中ad_gpo_extract_smb_components()函数未对gPCFileSysPath LDAP属性中的..序列进行清理，可能导致具有AD GPO管理权限的攻击者以root权限在GPO缓存目录之外写入文件，并通过注入Kerberos配置绕过身份验证。以下版本受到影响：Red Hat Enterprise Linux 10、Red Hat E

CVSS 8.0 · High EPSS 0.67% · P50 更新于 2026-09-03

可能的 ATT&CK 技术 3 AI

T1190 · Exploit Public-Facing Application T1078.002 · Domain Accounts T1546.007 · Netsh Helper DLL

影响版本矩阵 29

厂商	产品	版本范围	状态
Red Hat	Red Hat Enterprise Linux 10	`0:2.12.0-3.el10_2.1< *`	unaffected
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	`0:2.10.2-3.el10_0.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 6	`全部`	unknown
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	`0:1.16.5-10.el7_9.18< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8	`0:2.9.4-5.el8_10.5< *`	unaffected
		`0:2.9.4-5.el8_10.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	`0:2.4.0-9.el8_4.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	`0:2.4.0-9.el8_4.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	`0:2.6.2-4.el8_6.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	`0:2.6.2-4.el8_6.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	`0:2.8.2-4.el8_8.4< *`	unaffected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	`0:2.8.2-4.el8_8.4< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9	`0:2.9.8-4.el9_8.1< *`	unaffected
		`0:2.9.8-4.el9_8.1< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	`0:2.8.2-5.el9_2.7< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	`0:2.9.4-6.el9_4.5< *`	unaffected
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	`0:2.9.6-4.el9_6.5< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4	`全部`	affected
Red Hat	Red Hat OpenShift Container Platform 4.12	`412.86.202608241157-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.13	`413.92.202608111330-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.14	`414.92.202608172040-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.15	`415.92.202608180329-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.16	`416.94.202608150307-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.17	`417.94.202608250221-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.18	`418.94.202608142238-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.19	`4.19.9.6.202608120446-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.20	`4.20.9.6.202608121719-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.21	`4.21.9.6.202608122143-0< *`	unaffected
Red Hat	Red Hat OpenShift Container Platform 4.22	`4.22.9.8.202608130832-0< *`	unaffected

获取后续新漏洞提醒登录后订阅

一、漏洞 CVE-2026-14476 基础信息

漏洞信息

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！

查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

来源: CVE Program / CVE List V5

Vulnerability Description

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

来源: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

来源: CVE Program / CVE List V5

Vulnerability Type

相对路径遍历

来源: CVE Program / CVE List V5

Vulnerability Title

Red Hat sssd 路径遍历漏洞

来源: 中国国家信息安全漏洞库 CNNVD

Vulnerability Description

来源: 中国国家信息安全漏洞库 CNNVD

CVSS Information

N/A

来源: 中国国家信息安全漏洞库 CNNVD

Vulnerability Type

N/A

来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商	产品	影响版本	CPE
Red Hat	Red Hat Enterprise Linux 10	0:2.12.0-3.el10_2.1 ~ *	`cpe:/o:redhat:enterprise_linux:10.2`
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	0:2.10.2-3.el10_0.5 ~ *	`cpe:/o:redhat:enterprise_linux_eus:10.0`
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	0:1.16.5-10.el7_9.18 ~ *	`cpe:/o:redhat:rhel_els:7`
Red Hat	Red Hat Enterprise Linux 8	0:2.9.4-5.el8_10.5 ~ *	`cpe:/a:redhat:enterprise_linux:8::appstream`
Red Hat	Red Hat Enterprise Linux 8	0:2.9.4-5.el8_10.5 ~ *	`cpe:/a:redhat:enterprise_linux:8::appstream`
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	0:2.4.0-9.el8_4.5 ~ *	`cpe:/o:redhat:rhel_aus:8.4::baseos`
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	0:2.4.0-9.el8_4.5 ~ *	`cpe:/o:redhat:rhel_aus:8.4::baseos`
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	0:2.6.2-4.el8_6.5 ~ *	`cpe:/o:redhat:rhel_aus:8.6::baseos`
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	0:2.6.2-4.el8_6.5 ~ *	`cpe:/o:redhat:rhel_aus:8.6::baseos`
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	0:2.8.2-4.el8_8.4 ~ *	`cpe:/a:redhat:rhel_e4s:8.8::appstream`
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	0:2.8.2-4.el8_8.4 ~ *	`cpe:/a:redhat:rhel_e4s:8.8::appstream`
Red Hat	Red Hat Enterprise Linux 9	0:2.9.8-4.el9_8.1 ~ *	`cpe:/a:redhat:enterprise_linux:9::appstream`
Red Hat	Red Hat Enterprise Linux 9	0:2.9.8-4.el9_8.1 ~ *	`cpe:/a:redhat:enterprise_linux:9::appstream`
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	0:2.8.2-5.el9_2.7 ~ *	`cpe:/a:redhat:rhel_e4s:9.2::appstream`
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	0:2.9.4-6.el9_4.5 ~ *	`cpe:/a:redhat:rhel_e4s:9.4::appstream`
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	0:2.9.6-4.el9_6.5 ~ *	`cpe:/a:redhat:rhel_eus:9.6::appstream`
Red Hat	Red Hat OpenShift Container Platform 4.12	412.86.202608241157-0 ~ *	`cpe:/a:redhat:openshift:4.12::el8`
Red Hat	Red Hat OpenShift Container Platform 4.13	413.92.202608111330-0 ~ *	`cpe:/a:redhat:openshift:4.13::el9`
Red Hat	Red Hat OpenShift Container Platform 4.14	414.92.202608172040-0 ~ *	`cpe:/a:redhat:openshift:4.14::el9`
Red Hat	Red Hat OpenShift Container Platform 4.15	415.92.202608180329-0 ~ *	`cpe:/a:redhat:openshift:4.15::el9`
Red Hat	Red Hat OpenShift Container Platform 4.16	416.94.202608150307-0 ~ *	`cpe:/a:redhat:openshift:4.16::el9`
Red Hat	Red Hat OpenShift Container Platform 4.17	417.94.202608250221-0 ~ *	`cpe:/a:redhat:openshift:4.17::el9`
Red Hat	Red Hat OpenShift Container Platform 4.18	418.94.202608142238-0 ~ *	`cpe:/a:redhat:openshift:4.18::el9`
Red Hat	Red Hat OpenShift Container Platform 4.19	4.19.9.6.202608120446-0 ~ *	`cpe:/a:redhat:openshift:4.19::el9`
Red Hat	Red Hat OpenShift Container Platform 4.20	4.20.9.6.202608121719-0 ~ *	`cpe:/a:redhat:openshift:4.20::el9`
Red Hat	Red Hat OpenShift Container Platform 4.21	4.21.9.6.202608122143-0 ~ *	`cpe:/a:redhat:openshift:4.21::el9`
Red Hat	Red Hat OpenShift Container Platform 4.22	4.22.9.8.202608130832-0 ~ *	`cpe:/a:redhat:openshift:4.22::el9`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`

二、漏洞 CVE-2026-14476 的公开POC

#	POC 描述	源链接	神龙链接

AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-14476 的情报信息

请登录查看更多情报信息。

CVE-2026-14476 厂商安全公告 (23)

🔗 cve-details vdb-entry x_refsource_REDHAT
🔗 2496581 – (CVE-2026-14476) CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass 查看完整文章 issue-tracking x_refsource_REDHAT
🔗 RHSA-2026:46990 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:41937 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:54581 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:56911 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:59831 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:49839 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:54553 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:49843 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:57483 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:54769 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:49841 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:56853 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:49844 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:54599 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:54187 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:42122 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:49842 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:50109 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:56786 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:46482 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:60019 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-14476

同批安全公告 · Red Hat · 2026-07-07 · 共 7 条

CVE-2026-14474	8.8 HIGH	Red Hat sssd 配置错误漏洞
CVE-2026-58384	7.3 HIGH	GIMP 数字错误漏洞
CVE-2025-12799	6.5 MEDIUM	Undertow Jastow 跨站脚本漏洞
CVE-2026-14940	5.3 MEDIUM	389 Directory Server 缓冲区错误漏洞
CVE-2026-14969	4.4 MEDIUM	389 Directory Server 加密问题漏洞
CVE-2026-14935	3.7 LOW	GStreamer 处理逻辑错误漏洞

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10

Same vendor: Red Hat

Same weakness: CWE-23

V. Comments for CVE-2026-14476

暂无评论

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

CVE-2026-14476— Red Hat sssd 路径遍历漏洞

一分钟漏洞结论

可能的 ATT&CK 技术 3 AI

影响版本矩阵 29

一、 漏洞 CVE-2026-14476 基础信息

漏洞信息

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

受影响产品

二、漏洞 CVE-2026-14476 的公开POC

三、漏洞 CVE-2026-14476 的情报信息

CVE-2026-14476 厂商安全公告 (23)

同批安全公告 · Red Hat · 2026-07-07 · 共 7 条

IV. Related Vulnerabilities

V. Comments for CVE-2026-14476

发表评论

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

一、漏洞 CVE-2026-14476 基础信息