CVE-2026-59681

Name of the Vulnerable Software and Affected Versions yast2-auth-client (affected versions not specified)

Description An OS command injection flaw exists in the Auth::AuthConf function within src/lib/auth/authconf.rb. The issue occurs when the software assembles Samba net ads join, net ads lookup -S, and net ads testjoin invocations by interpolating configuration values into a single command string. This string is then passed to Open3.popen2 or Open3.capture2, causing Ruby to execute it via /bin/sh. An attacker who controls Active Directory configuration values can execute arbitrary commands as root on the host because the ou (Organizational Unit), dnshostname, AD user name, and AD domain name values are not validated or shell-quoted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.