Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Summary

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

Timeline

1. Jul 7, 2026, 9:12 AM UTCCVE published
2. Jul 7, 2026, 2:34 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 8, 2026, 10:44 PM UTCRecord last updated

Affected versions

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• sssd

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• sssd

  Version range not reported

References 24