high
8.0
CVE-2026-14476 json
Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
published 2026-07-07 4 mo ago modified 2026-11-05 3 d ago also EUVD-2026-42023
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
Patch / fix
- Red Hat Red Hat Enterprise Linux 10 0:2.12.0-3.el10_2.1
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.10.2-3.el10_0.5
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.16.5-10.el7_9.18
- Red Hat Red Hat Enterprise Linux 8 0:2.9.4-5.el8_10.5
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.4.0-9.el8_4.5
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.4.0-9.el8_4.5
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.6.2-4.el8_6.5
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:2.6.2-4.el8_6.5
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.8.2-4.el8_8.4
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.8.2-4.el8_8.4
- Red Hat Red Hat Enterprise Linux 9 0:2.9.8-4.el9_8.1
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.8.2-5.el9_2.7
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.9.4-6.el9_4.5
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.9.6-4.el9_6.5
- Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
- Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202608111330-0
- Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202608172040-0
- Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202608180329-0
- Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202608150307-0
- Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202608250221-0
- Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202608142238-0
- Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202608120446-0
- Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202608121719-0
- Red Hat Red Hat OpenShift Container Platform 4.21 4.21.9.6.202608122143-0
- Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202608130832-0
- sssd Debian 14 2.13.1-1
debian advisories DEBIAN-CVE-2026-14476
- sssd RHEL 8 2.9.4-5.el8_10.5
- sssd-ad RHEL 8 2.9.4-5.el8_10.5
- sssd-idp RHEL 8 2.9.4-5.el8_10.5
- sssd-ipa RHEL 8 2.9.4-5.el8_10.5
- sssd-kcm RHEL 8 2.9.4-5.el8_10.5
- sssd-dbus RHEL 8 2.9.4-5.el8_10.5
- sssd-krb5 RHEL 8 2.9.4-5.el8_10.5
- sssd-ldap RHEL 8 2.9.4-5.el8_10.5
red hat advisories RHSA-2026:50109RHSA-2026:49844RHSA-2026:49842RHSA-2026:49843RHSA-2026:49841RHSA-2026:49840
- sssd SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 2.5.2-150500.10.44.1
- sssd Linux Micro 6.1 2.9.5-slfo.1.1_5.1
- sssd SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 2.5.2-150400.4.45.1
- sssd Linux Micro 6.0 2.8.2-8.1
- sssd SLE Module for Basesystem 15 SP7 2.10.2-150700.9.34.1
- sssd SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.10.2-160000.3.1
- sssd SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.16.1-7.73.1
- sssd SLES for SAP 15 SP6, SLES 15 SP6-LTSS 2.10.2-150600.3.53.1
suse advisories SUSE-SU-2026:3195-1SUSE-SU-2026:22897-1SUSE-SU-2026:3139-1SUSE-SU-2026:3131-1SUSE-SU-2026:22799-1SUSE-SU-2026:3041-1
- sssd openSUSE Leap 16.0 2.10.2-160000.3.1
opensuse advisories openSUSE-SU-2026:21290-1
- sssd AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-ad AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-idp AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-ipa AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-kcm AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-dbus AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-krb5 AlmaLinux 8 2.9.4-5.el8_10.5
- sssd-ldap AlmaLinux 8 2.9.4-5.el8_10.5
almalinux advisories ALSA-2026:46990ALSA-2026:41937ALSA-2026:42122
- sssd Rocky Linux 8 2.9.4-5.el8_10.5
- sssd Rocky Linux 10 2.12.0-3.el10_2.1
- sssd Rocky Linux 9 2.9.8-4.el9_8.1
rocky linux advisories RLSA-2026:46990RLSA-2026:41937RLSA-2026:42122
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-14476 updated cvss 8.0
sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
-
Red Hat Enterprise Linux 6 sssd, sssd-ad, sssd-ipa, sssd-dbus, sssd-krb5, sssd-ldap, +19 moreaffected: workaround, no fix planned “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.”
-
Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9affected: workaround, no fix available “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.”
-
Red Hat CodeReady Linux Builder EUS (v.9.6) sssd-debuginfo 2.9.6-4.el9_6.5, sssd-debugsource 2.9.6-4.el9_6.5, sssd-ad-debuginfo 2.9.6-4.el9_6.5, sssd-idp-debuginfo 2.9.6-4.el9_6.5, sssd-ipa-debuginfo 2.9.6-4.el9_6.5, sssd-kcm-debuginfo 2.9.6-4.el9_6.5, +24 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49839
-
Red Hat Enterprise Linux AppStream (v. 8) sssd-idp 2.9.4-5.el8_10.5fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46990
-
Red Hat Enterprise Linux AppStream (v. 9) sssd-idp 2.9.8-4.el9_8.1fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:42122
-
Red Hat Enterprise Linux AppStream (v. 10) sssd-idp 2.12.0-3.el10_2.1fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:41937
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) sssd-idp 2.8.2-4.el8_8.4fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49842
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) sssd-idp 2.8.2-5.el9_2.7fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49843
show 31 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) sssd-idp 2.9.4-6.el9_4.5fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49840
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) sssd-idp 2.10.2-3.el10_0.5fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46482
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) sssd-idp 2.9.6-4.el9_6.5fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49839
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) sssd-idp 2.8.2-4.el8_8.4fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49842
-
Red Hat Enterprise Linux BaseOS (v. 8) sssd 2.9.4-5.el8_10.5, sssd-ad 2.9.4-5.el8_10.5, sssd-ipa 2.9.4-5.el8_10.5, sssd-kcm 2.9.4-5.el8_10.5, sssd-dbus 2.9.4-5.el8_10.5, sssd-krb5 2.9.4-5.el8_10.5, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46990
-
Red Hat Enterprise Linux BaseOS (v. 9) sssd 2.9.8-4.el9_8.1, sssd-ad 2.9.8-4.el9_8.1, sssd-ipa 2.9.8-4.el9_8.1, sssd-kcm 2.9.8-4.el9_8.1, sssd-dbus 2.9.8-4.el9_8.1, sssd-krb5 2.9.8-4.el9_8.1, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:42122
-
Red Hat Enterprise Linux BaseOS (v. 10) sssd 2.12.0-3.el10_2.1, sssd-ad 2.12.0-3.el10_2.1, sssd-ipa 2.12.0-3.el10_2.1, sssd-kcm 2.12.0-3.el10_2.1, sssd-dbus 2.12.0-3.el10_2.1, sssd-krb5 2.12.0-3.el10_2.1, +21 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:41937
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) sssd 2.4.0-9.el8_4.5, sssd-ad 2.4.0-9.el8_4.5, sssd-ipa 2.4.0-9.el8_4.5, sssd-kcm 2.4.0-9.el8_4.5, sssd-dbus 2.4.0-9.el8_4.5, sssd-krb5 2.4.0-9.el8_4.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49841
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) sssd 2.6.2-4.el8_6.5, sssd-ad 2.6.2-4.el8_6.5, sssd-ipa 2.6.2-4.el8_6.5, sssd-kcm 2.6.2-4.el8_6.5, sssd-dbus 2.6.2-4.el8_6.5, sssd-krb5 2.6.2-4.el8_6.5, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49844
-
Red Hat Enterprise Linux BaseOS E4S (v.8.8) sssd 2.8.2-4.el8_8.4, sssd-ad 2.8.2-4.el8_8.4, sssd-ipa 2.8.2-4.el8_8.4, sssd-kcm 2.8.2-4.el8_8.4, sssd-dbus 2.8.2-4.el8_8.4, sssd-krb5 2.8.2-4.el8_8.4, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49842
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) sssd 2.8.2-5.el9_2.7, sssd-ad 2.8.2-5.el9_2.7, sssd-ipa 2.8.2-5.el9_2.7, sssd-kcm 2.8.2-5.el9_2.7, sssd-dbus 2.8.2-5.el9_2.7, sssd-krb5 2.8.2-5.el9_2.7, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49843
-
Red Hat Enterprise Linux BaseOS E4S (v.9.4) sssd 2.9.4-6.el9_4.5, sssd-ad 2.9.4-6.el9_4.5, sssd-ipa 2.9.4-6.el9_4.5, sssd-kcm 2.9.4-6.el9_4.5, sssd-dbus 2.9.4-6.el9_4.5, sssd-krb5 2.9.4-6.el9_4.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49840
-
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) sssd 2.10.2-3.el10_0.5, sssd-ad 2.10.2-3.el10_0.5, sssd-ipa 2.10.2-3.el10_0.5, sssd-kcm 2.10.2-3.el10_0.5, sssd-dbus 2.10.2-3.el10_0.5, sssd-krb5 2.10.2-3.el10_0.5, +21 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46482
-
Red Hat Enterprise Linux BaseOS EUS (v.9.6) sssd 2.9.6-4.el9_6.5, sssd-ad 2.9.6-4.el9_6.5, sssd-ipa 2.9.6-4.el9_6.5, sssd-kcm 2.9.6-4.el9_6.5, sssd-dbus 2.9.6-4.el9_6.5, sssd-krb5 2.9.6-4.el9_6.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49839
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) sssd 2.4.0-9.el8_4.5, sssd-ad 2.4.0-9.el8_4.5, sssd-ipa 2.4.0-9.el8_4.5, sssd-kcm 2.4.0-9.el8_4.5, sssd-dbus 2.4.0-9.el8_4.5, sssd-krb5 2.4.0-9.el8_4.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49841
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) sssd 2.6.2-4.el8_6.5, sssd-ad 2.6.2-4.el8_6.5, sssd-ipa 2.6.2-4.el8_6.5, sssd-kcm 2.6.2-4.el8_6.5, sssd-dbus 2.6.2-4.el8_6.5, sssd-krb5 2.6.2-4.el8_6.5, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49844
-
Red Hat Enterprise Linux BaseOS TUS (v.8.8) sssd 2.8.2-4.el8_8.4, sssd-ad 2.8.2-4.el8_8.4, sssd-ipa 2.8.2-4.el8_8.4, sssd-kcm 2.8.2-4.el8_8.4, sssd-dbus 2.8.2-4.el8_8.4, sssd-krb5 2.8.2-4.el8_8.4, +22 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:49842
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) sssd-debuginfo 2.9.8-4.el9_8.1, sssd-debugsource 2.9.8-4.el9_8.1, sssd-ad-debuginfo 2.9.8-4.el9_8.1, libsss_idmap-devel 2.9.8-4.el9_8.1, sssd-idp-debuginfo 2.9.8-4.el9_8.1, sssd-ipa-debuginfo 2.9.8-4.el9_8.1, +26 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:42122
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) sssd-debuginfo 2.12.0-3.el10_2.1, sssd-debugsource 2.12.0-3.el10_2.1, sssd-ad-debuginfo 2.12.0-3.el10_2.1, sssd-idp-debuginfo 2.12.0-3.el10_2.1, sssd-ipa-debuginfo 2.12.0-3.el10_2.1, sssd-kcm-debuginfo 2.12.0-3.el10_2.1, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:41937
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) sssd-debuginfo 2.10.2-3.el10_0.5, sssd-debugsource 2.10.2-3.el10_0.5, sssd-ad-debuginfo 2.10.2-3.el10_0.5, sssd-idp-debuginfo 2.10.2-3.el10_0.5, sssd-ipa-debuginfo 2.10.2-3.el10_0.5, sssd-kcm-debuginfo 2.10.2-3.el10_0.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46482
-
Red Hat Enterprise Linux CRB (v. 8) sssd-debuginfo 2.9.4-5.el8_10.5, sssd-debugsource 2.9.4-5.el8_10.5, sssd-ad-debuginfo 2.9.4-5.el8_10.5, sssd-idp-debuginfo 2.9.4-5.el8_10.5, sssd-ipa-debuginfo 2.9.4-5.el8_10.5, sssd-kcm-debuginfo 2.9.4-5.el8_10.5, +23 morefixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:46990
-
Red Hat Enterprise Linux Server (v. 7 ELS) sssd 1.16.5-10.el7_9.18, sssd-ad 1.16.5-10.el7_9.18, sssd-ipa 1.16.5-10.el7_9.18, sssd-kcm 1.16.5-10.el7_9.18, sssd-dbus 1.16.5-10.el7_9.18, sssd-krb5 1.16.5-10.el7_9.18, +22 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-libsss_nss_idmap 1.16.5-10.el7_9.18fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:50109
-
Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:59831
-
Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202608111330fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:54187
-
Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202608172040fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:56786
-
Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202608180329fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:56911
-
Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202608150307fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:56853
-
Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202608250221fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:60019
-
Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202608142238fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:57483
-
Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202608120446fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:54553
-
Red Hat OpenShift Container Platform 4.20 rhcos 4.20.9.6.202608121719fixed: vendor fix “Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.” RHSA-2026:54581
2 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.12
- Red Hat Red Hat OpenShift Container Platform 4.13
- Red Hat Red Hat OpenShift Container Platform 4.14
- Red Hat Red Hat OpenShift Container Platform 4.15
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.18
- Red Hat Red Hat OpenShift Container Platform 4.19
- Red Hat Red Hat OpenShift Container Platform 4.20
- Red Hat Red Hat OpenShift Container Platform 4.21
- Red Hat Red Hat OpenShift Container Platform 4.22
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat OpenShift Container Platform 5
Classification
- Weakness
-
- CWE-23 Relative Path Traversal
References
-
access.redhat.com
/errata/RHSA-2026:41937
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42122
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46482
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:46990
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49839
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49840
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49841
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49842
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49843
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:49844
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:50109
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54187
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54553
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54581
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54599
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54769
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56786
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56853
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:56911
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:57483
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:59831
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:60019
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2026-14476
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2496581
issue-tracking
Sources
- CVE List CVE-2026-14476
- NVD CVE-2026-14476
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.