Skip to content
Advisories.
Red HatCVE-2026-14474

Red Hat SSSD: insecure default

High8.8CVE-2026-14474 · Published Jul 7, 2026 · updated Sep 3, 2026

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Red Hat advisory

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-1188

More Red Hat advisories

All Red Hat
Advisory
Red Hat Jastow: cross-site scripting
Medium6.5Jul 7
Red Hat GStreamer: incorrect control flow
Low3.7Jul 7
Red Hat 389-ds-base: attacker could detect plaintext equality across encrypted
Medium4.4Jul 7
Red Hat Directory Server 11: denial of service
Medium5.3Jul 7
Red Hat 389-ds-base: buffer overflow
High8.8Jul 7
Red Hat SSSD: path traversal
High8.0Jul 7

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.