Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

Summary

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Timeline

1. Jul 7, 2026, 9:12 AM UTCCVE published
2. Jul 7, 2026, 1:41 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 8, 2026, 8:44 PM UTCRecord last updated

Affected versions

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• sssd

  Version range not reported

References 24