CVE-2026-59681— yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join
Quick assessment
Affected
SUSE yast2-auth-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
yast2-auth-client 中存在一个操作系统命令注入漏洞。能够控制活动目录（Active Directory）配置值的攻击者可以利用该漏洞，在目标主机上以 root 权限执行任意命令。 具体来说，位于 中的 模块在组装 、 和 命令时，通过将配置值直接插入到一个命令字符串中，并将该字符串传递给 / 执行。这会导致 Ruby 通过 来运行该命令。由于组织单元（OU）、DNS 主机名（dnshostname）、活动目录用户名（AD user name）和活动目录域名（AD domain name）这些值既未经
Possible ATT&CK Techniques 2 AI
T1003 · OS Credential Dumping T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59681
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join
Source: CVE Program / CVE List V5
Vulnerability Description
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host.
Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SUSE | yast2-auth-client | 0 ~ 5.0.4 | - |
|
II. Public POCs for CVE-2026-59681
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59681
请登录查看更多情报信息。
Other References for CVE-2026-59681 (1)
-
🔗 Making sure you're not a bot! issue-tracking
Same Patch Batch · SUSE · 2026-09-01 · 3 CVEs total
| CVE-2026-59680 | 8.0 HIGH | yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribut |
| CVE-2026-25706 | 7.5 HIGH | yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Acti |
IV. Related Vulnerabilities
Same vendor: SUSE
-
CVE-2026-25706
yast2-samba-client: OS command injection via attacker-contro -
CVE-2026-59680
yast2-users: OS command injection via LDAP-supplied shadowLa -
CVE-2026-71402
wicked: out-of-bounds read in the DHCPv4 option parser due t -
CVE-2026-71401
wicked: integer underflow of the UDP length in ni_capture_in -
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala
Same weakness: CWE-78
-
CVE-2026-84194
LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Host -
CVE-2026-25706
yast2-samba-client: OS command injection via attacker-contro -
CVE-2026-59680
yast2-users: OS command injection via LDAP-supplied shadowLa -
CVE-2026-67394
Plesk Linux 18.0.79.9前本地提权命令注入 -
CVE-2026-82703
Edimax BR-6214K asp_setPing Endpoint ping.asp system os comm
V. Comments for CVE-2026-59681
No comments yet