{"id":"CVE-2026-14474","title":"A flaw was found in SSSD's LDAP sudo provider","summary":"A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subt…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-1188"],"published":"2026-07-07","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:55.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14474","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:41937","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42122","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:46482","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:46990","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49839","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49840","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49841","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49842","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49843","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49844","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50109","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54187","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54553","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54581","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54599","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56786","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56853","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56911","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57483","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59831","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:60019","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-14474","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496556","label":"secalert@redhat.com"}],"tags":["nvd","cve.org"],"epss":0.00568,"epssPercentile":0.46869,"ingestedAt":"2026-07-27T12:18:01.659Z","vendor":"Red Hat","product":"sssd","affected":["sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","sssd (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","sssd"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-07T13:41:44.076680Z"},"slug":"CVE-2026-14474","body":"## Overview\n\nA flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}