RLSA-2026:46990

Synopsis

Important: sssd security, bug fix, and enhancement update

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

Security Fix(es):

* sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)

* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476)

Bug Fix(es) and Enhancement(s):

* sss_override does not work on AD UPN [rhel-8.10.z] (JIRA:Rocky Linux-168363)

* [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z] (JIRA:Rocky Linux-168415)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 8 aarch64 Rocky Linux 8 x86_64

Fixes

2496556 2496581

CVEs

CVE-2026-14474 CVE-2026-14476

Affected packages

Rocky Linux 8 aarch64 - BaseOS

libipa_hbac-0:2.9.4-5.el8_10.5.aarch64.rpm libipa_hbac-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_autofs-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_autofs-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_certmap-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_certmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_idmap-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_idmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_nss_idmap-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_nss_idmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_simpleifp-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_simpleifp-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_sudo-0:2.9.4-5.el8_10.5.aarch64.rpm libsss_sudo-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm python3-libipa_hbac-0:2.9.4-5.el8_10.5.aarch64.rpm python3-libipa_hbac-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm python3-libsss_nss_idmap-0:2.9.4-5.el8_10.5.aarch64.rpm python3-libsss_nss_idmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm python3-sss-0:2.9.4-5.el8_10.5.aarch64.rpm python3-sssdconfig-0:2.9.4-5.el8_10.5.noarch.rpm python3-sss-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm python3-sss-murmur-0:2.9.4-5.el8_10.5.aarch64.rpm python3-sss-murmur-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-0:2.9.4-5.el8_10.5.src.rpm sssd-ad-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-ad-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-client-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-client-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-common-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-common-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-common-pac-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-common-pac-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-dbus-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-dbus-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-debugsource-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-ipa-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-ipa-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-kcm-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-kcm-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-krb5-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-krb5-common-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-krb5-common-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-krb5-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-ldap-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-ldap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-nfs-idmap-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-nfs-idmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-polkit-rules-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-proxy-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-proxy-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-tools-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-tools-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-winbind-idmap-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-winbind-idmap-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm

Rocky Linux 8 x86_64 - BaseOS

libipa_hbac-0:2.9.4-5.el8_10.5.i686.rpm libipa_hbac-0:2.9.4-5.el8_10.5.x86_64.rpm libipa_hbac-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm libipa_hbac-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_autofs-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_autofs-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_certmap-0:2.9.4-5.el8_10.5.i686.rpm libsss_certmap-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_certmap-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm libsss_certmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_idmap-0:2.9.4-5.el8_10.5.i686.rpm libsss_idmap-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_idmap-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm libsss_idmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_nss_idmap-0:2.9.4-5.el8_10.5.i686.rpm libsss_nss_idmap-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_nss_idmap-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm libsss_nss_idmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_simpleifp-0:2.9.4-5.el8_10.5.i686.rpm libsss_simpleifp-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_simpleifp-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm libsss_simpleifp-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_sudo-0:2.9.4-5.el8_10.5.x86_64.rpm libsss_sudo-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm python3-libipa_hbac-0:2.9.4-5.el8_10.5.x86_64.rpm python3-libipa_hbac-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm python3-libsss_nss_idmap-0:2.9.4-5.el8_10.5.x86_64.rpm python3-libsss_nss_idmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm python3-sss-0:2.9.4-5.el8_10.5.x86_64.rpm python3-sssdconfig-0:2.9.4-5.el8_10.5.noarch.rpm python3-sss-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm python3-sss-murmur-0:2.9.4-5.el8_10.5.x86_64.rpm python3-sss-murmur-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-0:2.9.4-5.el8_10.5.src.rpm sssd-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ad-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ad-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-client-0:2.9.4-5.el8_10.5.i686.rpm sssd-client-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-client-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm sssd-client-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-common-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-common-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-common-pac-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-common-pac-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-dbus-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-dbus-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-debuginfo-0:2.9.4-5.el8_10.5.i686.rpm sssd-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-debugsource-0:2.9.4-5.el8_10.5.i686.rpm sssd-debugsource-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ipa-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ipa-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-kcm-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-kcm-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-krb5-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-krb5-common-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-krb5-common-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-krb5-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ldap-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-ldap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-nfs-idmap-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-nfs-idmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-polkit-rules-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-proxy-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-proxy-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-tools-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-tools-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-winbind-idmap-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-winbind-idmap-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm

Rocky Linux 8 aarch64 - PowerTools

libsss_nss_idmap-devel-0:2.9.4-5.el8_10.5.aarch64.rpm

Rocky Linux 8 x86_64 - PowerTools

libsss_nss_idmap-devel-0:2.9.4-5.el8_10.5.i686.rpm libsss_nss_idmap-devel-0:2.9.4-5.el8_10.5.x86_64.rpm

Rocky Linux 8 aarch64 - AppStream

sssd-idp-0:2.9.4-5.el8_10.5.aarch64.rpm sssd-idp-debuginfo-0:2.9.4-5.el8_10.5.aarch64.rpm

Rocky Linux 8 x86_64 - AppStream

sssd-idp-0:2.9.4-5.el8_10.5.x86_64.rpm sssd-idp-debuginfo-0:2.9.4-5.el8_10.5.x86_64.rpm