CVE-2026-14476: Relative Path Traversal in Red Hat Red Hat Enterprise Linux 10

A path traversal flaw exists in the ad_gpo_extract_smb_components() function of SSSD's AD GPO provider, which fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute. This allows an attacker with AD GPO management privileges to write files outside the GPO cache directory with root privileges. On default RHEL systems with SELinux enforcing, this can be exploited to inject Kerberos configuration files, potentially bypassing authentication mechanisms. Red Hat has released a security update for Red Hat Enterprise Linux 10 to fix this issue and recommends disabling GPO fetching as a mitigation if patching is not immediately possible.

An attacker with Active Directory GPO management access can exploit this vulnerability to write arbitrary files as root outside the intended GPO cache directory. This can lead to Kerberos authentication bypass on systems with SELinux enforcing by injecting malicious Kerberos configuration. The vulnerability affects confidentiality, integrity, and availability by allowing unauthorized code execution, file modification, and potential denial of service. However, exploitation requires high privileges and SELinux limits the scope of impact by blocking writes to most critical system paths.

Red Hat has released an official security update that fixes this vulnerability. Users should apply the update to the affected SSSD packages on Red Hat Enterprise Linux 10 as soon as possible. As a temporary mitigation, administrators can disable GPO fetching by setting 'ad_gpo_access_control = disabled' in /etc/sssd/sssd.conf, though this will remove GPO-based login policy enforcement. SELinux enforcing mode also limits the impact by restricting writes to critical system paths.