8.0
High
A path traversal flaw was found in SSSD's AD GPO provider.
CVE-2026-14476
A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
Assessment
- CVSS
- 8 (v3.1)
- Severity
- High
- EPSS
- 0.67% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 7 July 2026
- Last updated
- 30 October 2026
- Affected
- Red Hat
- Assigner
- redhat
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
At the source
References
- https://access.redhat.com/errata/RHSA-2026:41937
- https://access.redhat.com/errata/RHSA-2026:42122
- https://access.redhat.com/errata/RHSA-2026:46482
- https://access.redhat.com/errata/RHSA-2026:46990
- https://access.redhat.com/errata/RHSA-2026:49839
- https://access.redhat.com/errata/RHSA-2026:49840
- https://access.redhat.com/errata/RHSA-2026:49841
- https://access.redhat.com/errata/RHSA-2026:49842
- https://access.redhat.com/errata/RHSA-2026:49843
- https://access.redhat.com/errata/RHSA-2026:49844
- https://access.redhat.com/errata/RHSA-2026:50109
- https://access.redhat.com/errata/RHSA-2026:54187
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-14476