CVE-2026-14474

Name of the Vulnerable Software and Affected Versions sssd (affected versions not specified) rhcos (affected versions not specified)

Description A flaw exists in the SSSD LDAP sudo provider due to insecure default configuration and improper scoping of LDAP searches. When the ldap sudo search base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any LDAP subtree can inject a crafted sudoRole object, allowing them to grant themselves root-level sudo privileges on all SSSD-enrolled hosts, potentially leading to full system compromise and lateral movement.

Recommendations Upgrade to a vendor-fixed version. As a temporary mitigation, explicitly set the ldap sudo search base option.