[Sssd-maintainers] [Bug 2497651] New: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=2497651

Bug ID: 2497651
           Summary: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches
                    entire directory tree for sudoRole objects by default,
                    enabling privilege escalation [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["58986166-cf06-41ca-a3ec-716c8928d097"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: high
          Priority: high
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
            Blocks: 2496556 (CVE-2026-14474)
  Target Milestone: ---
    Classification: Fedora

Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.

When ldap_sudo_search_base is not explicitly configured (the default), SSSD
falls back to the domain's root DN and searches the entire LDAP directory tree
for objects matching (objectClass=sudoRole) with SUBTREE scope. Any LDAP
principal with write access to any subtree can create a sudoRole object
granting arbitrary sudo privileges on every SSSD-enrolled host.

This affects sudo_provider = ldap and sudo_provider = ad (which delegates to
sdap_sudo_init()). sudo_provider = ipa is NOT affected.

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2496556
[Bug 2496556] CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire
directory tree for sudoRole objects by default, enabling privilege escalation