SSSD AD GPO Provider Path Traversal Enables Kerberos Bypass (CVE-2026-14476)

Vulnerability Overview Vulnerability ID: CVE-2026-14476 Vulnerability Type: GPO Cache Path Traversal Vulnerability Description: In the SSSD AD GPO provider, the function converts backslashes to forward slashes but fails to sanitize path components. This allows an attacker to access files outside the GPO cache directory via AD GPO management, enabling Kerberos KDC redirection and authentication bypass. Affected Scope Affected Systems: SELinux Enforcing systems (default on RHEL) Affected Path: (labeled ) Impact: Enables Kerberos KDC redirection and authentication bypass. On SELinux Permissive or disabled systems, arbitrary file writes as root are possible. Remediation Fixed Version: Not specified Status: Unpatched Recommendations: - Sanitize path components to prevent path traversal. - Ensure SELinux policies are correctly configured to restrict access to sensitive files. POC Code No specific POC code or exploit code was provided in the page. Additional Information Reported Date: 2026-07-02 15:32 UTC Modified Date: 2026-07-07 08:09 UTC Severity: Medium Priority: Medium Target Milestone: Not specified Assigned To: Product Security QA Contact: Not specified Documentation Contact: Not specified URL: Not specified Whiteboard: Not specified Dependencies: 2497650 Blocks: Not specified Tree View: Depends on/Blocks Attachments Attachments: Not specified Notes Login is required to comment or modify this vulnerability. --- Summary: This vulnerability involves a path traversal issue in the SSSD AD GPO provider, which may lead to Kerberos authentication bypass. Remediation includes sanitizing path components and properly configuring SELinux policies.

Goal Reached Thanks to every supporter — we hit 100%!

SSSD AD GPO Provider Path Traversal Enables Kerberos Bypass (CVE-2026-14476)

More from this source