New subject: [Bug 2497650] CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass [fedora-all]

7 Jul 2026

      https://bugzilla.redhat.com/show_bug.cgi?id=2497650
Bug ID: 2497650
           Summary: CVE-2026-14476 sssd: sssd: GPO cache path traversal
                    via unsanitized gPCFileSysPath allows Kerberos
                    authentication bypass [fedora-all]
           Product: Fedora
           Version: rawhide
            Status: NEW
        Whiteboard: {"flaws": ["0c66f03b-252f-48f9-9e00-10588a9a2e5b"]}
         Component: sssd
          Keywords: Security, SecurityTracking
          Severity: medium
          Priority: medium
          Assignee: sssd-maintainers@lists.fedoraproject.org
          Reporter: snegrini@redhat.com
        QA Contact: extras-qa@fedoraproject.org
                CC: abokovoy@redhat.com, atikhono@redhat.com,
                    lslebodn@redhat.com, pbrezina@redhat.com,
                    sbose@redhat.com, ssorce@redhat.com,
                    sssd-maintainers@lists.fedoraproject.org
            Blocks: 2496581 (CVE-2026-14476)
  Target Milestone: ---
    Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The ad_gpo_extract_smb_components() function in SSSD's AD GPO provider converts
backslashes to forward slashes in the gPCFileSysPath LDAP attribute but does
not sanitize .. path components. A differential between libsmbclient's path
clamping (resolves .. at the share root) and the kernel's path resolution
(resolves .. fully) allows an attacker with AD GPO management access to write
files outside the GPO cache directory as root.
On SELinux-enforcing systems (the default on RHEL), the traversal can target
/var/lib/sss/pubconf/krb5.include.d/ (labeled sssd_public_t), enabling Kerberos
KDC redirection and authentication bypass. On SELinux-permissive or disabled
systems, arbitrary file write as root is possible.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2496581
[Bug 2496581] CVE-2026-14476 sssd: sssd: GPO cache path traversal via
unsanitized gPCFileSysPath allows Kerberos authentication bypass
-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2497650

Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

[Bug 2497650] New: CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass [fedora-all]