Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-07T09:00:00 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-1188

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Red Hat has rated this as Important because the attack requires only low-privilege delegated LDAP write access to any subtree, which is a common delegation pattern in enterprise environments. The default ldap_sudo_search_base configuration searches the entire directory tree, allowing sudo rule injection from outside the intended sudoers container. This issue was discovered by Ian Murphy (Red Hat). Set ldap_sudo_search_base explicitly in /etc/sssd/sssd.conf to restrict the search to the designated sudoers container: [domain/example.com] ldap_sudo_search_base = ou=sudoers,dc=example,dc=com Additionally, restrict LDAP ACLs to prevent non-admin principals from creating sudoRole objects outside the designated sudoers container. Red Hat Enterprise Linux 10 2026-07-20T00:00:00Z RHSA-2026:41937 sssd-0:2.12.0-3.el10_2.1 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-07-27T00:00:00Z RHSA-2026:46482 sssd-0:2.10.2-3.el10_0.5 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-08-04T00:00:00Z RHSA-2026:50109 sssd-0:1.16.5-10.el7_9.18 Red Hat Enterprise Linux 8 2026-07-28T00:00:00Z RHSA-2026:46990 sssd-0:2.9.4-5.el8_10.5 Red Hat Enterprise Linux 8 2026-07-28T00:00:00Z RHSA-2026:46990 sssd-0:2.9.4-5.el8_10.5 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-08-04T00:00:00Z RHSA-2026:49841 sssd-0:2.4.0-9.el8_4.5 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-08-04T00:00:00Z RHSA-2026:49841 sssd-0:2.4.0-9.el8_4.5 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-08-04T00:00:00Z RHSA-2026:49844 sssd-0:2.6.2-4.el8_6.5 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-08-04T00:00:00Z RHSA-2026:49844 sssd-0:2.6.2-4.el8_6.5 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-08-04T00:00:00Z RHSA-2026:49842 sssd-0:2.8.2-4.el8_8.4 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-08-04T00:00:00Z RHSA-2026:49842 sssd-0:2.8.2-4.el8_8.4 Red Hat Enterprise Linux 9 2026-07-20T00:00:00Z RHSA-2026:42122 sssd-0:2.9.8-4.el9_8.1 Red Hat Enterprise Linux 9 2026-07-20T00:00:00Z RHSA-2026:42122 sssd-0:2.9.8-4.el9_8.1 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-08-04T00:00:00Z RHSA-2026:49843 sssd-0:2.8.2-5.el9_2.7 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-08-04T00:00:00Z RHSA-2026:49840 sssd-0:2.9.4-6.el9_4.5 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-04T00:00:00Z RHSA-2026:49839 sssd-0:2.9.6-4.el9_6.5 Red Hat Enterprise Linux 6 Out of support scope sssd Red Hat OpenShift Container Platform 4 Affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-14474 https://nvd.nist.gov/vuln/detail/CVE-2026-14474