High severity8.8NVD Advisory· Published Jul 7, 2026· Updated Aug 21, 2026
CVE-2026-14474
CVE-2026-14474
Description
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
33- osv-coords32 versionspkg:rpm/almalinux/libipa_hbacpkg:rpm/almalinux/libsss_autofspkg:rpm/almalinux/libsss_certmappkg:rpm/almalinux/libsss_idmappkg:rpm/almalinux/libsss_nss_idmappkg:rpm/almalinux/libsss_nss_idmap-develpkg:rpm/almalinux/libsss_simpleifppkg:rpm/almalinux/libsss_sudopkg:rpm/almalinux/python3-libipa_hbacpkg:rpm/almalinux/python3-libsss_nss_idmappkg:rpm/almalinux/python3-ssspkg:rpm/almalinux/python3-sss-murmurpkg:rpm/almalinux/python3-sssdconfigpkg:rpm/almalinux/sssdpkg:rpm/almalinux/sssd-adpkg:rpm/almalinux/sssd-clientpkg:rpm/almalinux/sssd-commonpkg:rpm/almalinux/sssd-common-pacpkg:rpm/almalinux/sssd-dbuspkg:rpm/almalinux/sssd-idppkg:rpm/almalinux/sssd-ipapkg:rpm/almalinux/sssd-kcmpkg:rpm/almalinux/sssd-krb5pkg:rpm/almalinux/sssd-krb5-commonpkg:rpm/almalinux/sssd-ldappkg:rpm/almalinux/sssd-nfs-idmappkg:rpm/almalinux/sssd-passkeypkg:rpm/almalinux/sssd-polkit-rulespkg:rpm/almalinux/sssd-proxypkg:rpm/almalinux/sssd-toolspkg:rpm/almalinux/sssd-winbind-idmappkg:rpm/opensuse/sssd&distro=openSUSE%20Leap%2016.0
< 2.12.0-3.el10_2.1+ 31 more
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.9.8-4.el9_8.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.9.4-5.el8_10.5
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.12.0-3.el10_2.1
- (no CPE)range: < 2.10.2-160000.3.1
Patches
Vulnerability mechanics
References
18- access.redhat.com/errata/RHSA-2026:41937nvd
- access.redhat.com/errata/RHSA-2026:42122nvd
- access.redhat.com/errata/RHSA-2026:46482nvd
- access.redhat.com/errata/RHSA-2026:46990nvd
- access.redhat.com/errata/RHSA-2026:49839nvd
- access.redhat.com/errata/RHSA-2026:49840nvd
- access.redhat.com/errata/RHSA-2026:49841nvd
- access.redhat.com/errata/RHSA-2026:49842nvd
- access.redhat.com/errata/RHSA-2026:49843nvd
- access.redhat.com/errata/RHSA-2026:49844nvd
- access.redhat.com/errata/RHSA-2026:50109nvd
- access.redhat.com/errata/RHSA-2026:54187nvd
- access.redhat.com/errata/RHSA-2026:54553nvd
- access.redhat.com/errata/RHSA-2026:54581nvd
- access.redhat.com/errata/RHSA-2026:54599nvd
- access.redhat.com/errata/RHSA-2026:54769nvd
- access.redhat.com/security/cve/CVE-2026-14474nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
0No linked articles in our index yet.