RLSA-2026:41937

Synopsis

Important: sssd security update

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

* sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)

* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2496556 2496581

CVEs

CVE-2026-14474 CVE-2026-14476

Affected packages

Rocky Linux 10 aarch64 - BaseOS

sssd-tools-0:2.12.0-3.el10_2.1.aarch64.rpm python3-sss-murmur-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-krb5-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-common-pac-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-common-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-krb5-common-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-common-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_autofs-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_autofs-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ldap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm python3-sss-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ad-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-client-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_idmap-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-krb5-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-passkey-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-nfs-idmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-nfs-idmap-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ipa-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ldap-0:2.12.0-3.el10_2.1.aarch64.rpm python3-libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libipa_hbac-0:2.12.0-3.el10_2.1.aarch64.rpm libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-dbus-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-krb5-common-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_certmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-passkey-0:2.12.0-3.el10_2.1.aarch64.rpm python3-sssdconfig-0:2.12.0-3.el10_2.1.noarch.rpm sssd-debugsource-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_certmap-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ad-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_nss_idmap-0:2.12.0-3.el10_2.1.aarch64.rpm python3-sss-murmur-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm python3-libsss_nss_idmap-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-winbind-idmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm python3-sss-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-tools-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-0:2.12.0-3.el10_2.1.src.rpm sssd-client-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-winbind-idmap-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_idmap-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-proxy-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_sudo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-ipa-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-proxy-0:2.12.0-3.el10_2.1.aarch64.rpm libsss_sudo-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm python3-libipa_hbac-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-kcm-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-dbus-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-common-pac-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm python3-libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-kcm-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm

Rocky Linux 10 s390x - BaseOS

sssd-winbind-idmap-0:2.12.0-3.el10_2.1.s390x.rpm sssd-ad-0:2.12.0-3.el10_2.1.s390x.rpm python3-sss-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-ldap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-tools-0:2.12.0-3.el10_2.1.s390x.rpm sssd-0:2.12.0-3.el10_2.1.s390x.rpm sssd-proxy-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libipa_hbac-0:2.12.0-3.el10_2.1.s390x.rpm libsss_sudo-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-client-0:2.12.0-3.el10_2.1.s390x.rpm sssd-common-pac-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-krb5-common-0:2.12.0-3.el10_2.1.s390x.rpm sssd-dbus-0:2.12.0-3.el10_2.1.s390x.rpm sssd-nfs-idmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm python3-libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_certmap-0:2.12.0-3.el10_2.1.s390x.rpm python3-sssdconfig-0:2.12.0-3.el10_2.1.noarch.rpm sssd-ldap-0:2.12.0-3.el10_2.1.s390x.rpm python3-sss-murmur-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-common-0:2.12.0-3.el10_2.1.s390x.rpm libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_sudo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_nss_idmap-0:2.12.0-3.el10_2.1.s390x.rpm sssd-0:2.12.0-3.el10_2.1.src.rpm sssd-dbus-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_autofs-0:2.12.0-3.el10_2.1.s390x.rpm libsss_idmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_autofs-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-debugsource-0:2.12.0-3.el10_2.1.s390x.rpm sssd-nfs-idmap-0:2.12.0-3.el10_2.1.s390x.rpm sssd-krb5-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-ad-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-client-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-winbind-idmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm python3-libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libsss_certmap-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-krb5-0:2.12.0-3.el10_2.1.s390x.rpm sssd-ipa-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm python3-sss-0:2.12.0-3.el10_2.1.s390x.rpm sssd-common-pac-0:2.12.0-3.el10_2.1.s390x.rpm sssd-kcm-0:2.12.0-3.el10_2.1.s390x.rpm sssd-passkey-0:2.12.0-3.el10_2.1.s390x.rpm libsss_idmap-0:2.12.0-3.el10_2.1.s390x.rpm sssd-common-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-kcm-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-krb5-common-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-ipa-0:2.12.0-3.el10_2.1.s390x.rpm python3-libipa_hbac-0:2.12.0-3.el10_2.1.s390x.rpm sssd-passkey-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-tools-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-proxy-0:2.12.0-3.el10_2.1.s390x.rpm python3-libsss_nss_idmap-0:2.12.0-3.el10_2.1.s390x.rpm python3-sss-murmur-0:2.12.0-3.el10_2.1.s390x.rpm

Rocky Linux 10 x86_64 - BaseOS

sssd-nfs-idmap-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ad-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm python3-libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-kcm-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_sudo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ldap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm libipa_hbac-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-proxy-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-winbind-idmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-tools-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-tools-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-client-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_idmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-debugsource-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-krb5-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ipa-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-dbus-0:2.12.0-3.el10_2.1.x86_64.rpm python3-sss-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-proxy-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-passkey-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ldap-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_sudo-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm python3-sssdconfig-0:2.12.0-3.el10_2.1.noarch.rpm sssd-krb5-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-krb5-common-0:2.12.0-3.el10_2.1.x86_64.rpm python3-libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-client-0:2.12.0-3.el10_2.1.x86_64.rpm python3-libsss_nss_idmap-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_autofs-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_certmap-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-krb5-common-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-common-pac-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-0:2.12.0-3.el10_2.1.src.rpm sssd-dbus-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_idmap-0:2.12.0-3.el10_2.1.x86_64.rpm libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-nfs-idmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm python3-sss-murmur-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-common-pac-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ad-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_autofs-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-ipa-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_certmap-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-winbind-idmap-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-common-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm python3-libipa_hbac-0:2.12.0-3.el10_2.1.x86_64.rpm libsss_nss_idmap-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-kcm-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-passkey-0:2.12.0-3.el10_2.1.x86_64.rpm python3-sss-0:2.12.0-3.el10_2.1.x86_64.rpm python3-sss-murmur-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-common-0:2.12.0-3.el10_2.1.x86_64.rpm

Rocky Linux 10 ppc64le - BaseOS

sssd-winbind-idmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-sss-murmur-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ipa-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_autofs-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_sudo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-common-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_certmap-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-krb5-common-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-proxy-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-dbus-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-passkey-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_idmap-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-kcm-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_certmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-client-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-libipa_hbac-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-krb5-common-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-libsss_nss_idmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-winbind-idmap-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ipa-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-common-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-nfs-idmap-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-sssdconfig-0:2.12.0-3.el10_2.1.noarch.rpm libsss_idmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-krb5-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-tools-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-sss-murmur-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-libsss_nss_idmap-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-0:2.12.0-3.el10_2.1.src.rpm libipa_hbac-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-client-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-sss-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-proxy-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ldap-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-krb5-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_autofs-0:2.12.0-3.el10_2.1.ppc64le.rpm python3-sss-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-common-pac-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-passkey-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-dbus-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_sudo-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ad-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-nfs-idmap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-kcm-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-tools-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-debugsource-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ad-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-ldap-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm libsss_nss_idmap-0:2.12.0-3.el10_2.1.ppc64le.rpm libipa_hbac-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-common-pac-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm

Rocky Linux 10 ppc64le - AppStream

sssd-idp-0:2.12.0-3.el10_2.1.ppc64le.rpm sssd-idp-debuginfo-0:2.12.0-3.el10_2.1.ppc64le.rpm

Rocky Linux 10 s390x - AppStream

sssd-idp-debuginfo-0:2.12.0-3.el10_2.1.s390x.rpm sssd-idp-0:2.12.0-3.el10_2.1.s390x.rpm

Rocky Linux 10 aarch64 - AppStream

sssd-idp-0:2.12.0-3.el10_2.1.aarch64.rpm sssd-idp-debuginfo-0:2.12.0-3.el10_2.1.aarch64.rpm

Rocky Linux 10 x86_64 - AppStream

sssd-idp-debuginfo-0:2.12.0-3.el10_2.1.x86_64.rpm sssd-idp-0:2.12.0-3.el10_2.1.x86_64.rpm

Rocky Linux 10 aarch64 - CRB

libsss_nss_idmap-devel-0:2.12.0-3.el10_2.1.aarch64.rpm

Rocky Linux 10 riscv64 - BaseOS

python3-sssdconfig-0:2.12.0-3.el10_2.1.noarch.rpm sssd-0:2.12.0-3.el10_2.1.src.rpm

Rocky Linux 10 ppc64le - CRB

libsss_nss_idmap-devel-0:2.12.0-3.el10_2.1.ppc64le.rpm

Rocky Linux 10 x86_64 - CRB

libsss_nss_idmap-devel-0:2.12.0-3.el10_2.1.x86_64.rpm

Rocky Linux 10 s390x - CRB

libsss_nss_idmap-devel-0:2.12.0-3.el10_2.1.s390x.rpm