CVE-2026-14474: Initialization of a Resource with an Insecure Default in Red Hat Red Hat Enterprise Linux 10

The vulnerability CVE-2026-14474 affects the SSSD sudo LDAP provider in Red Hat Enterprise Linux 10. By default, if the ldap_sudo_search_base option is not configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write permissions to any LDAP subtree can exploit this by injecting a sudoRole object that grants root-level sudo privileges on all hosts using SSSD, enabling privilege escalation. Red Hat has issued a security advisory and released patches that restrict the search scope to prevent this behavior. The vulnerability carries a CVSS 3.1 base score of 8.8 (high severity) with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability at a high level. The fix is included in updated sssd packages in Red Hat Enterprise Linux 10.2 and later.

An authenticated attacker with write access to any LDAP subtree can escalate privileges to root on all SSSD-enrolled hosts by injecting sudoRole objects due to the default behavior of searching the entire LDAP directory tree. This can lead to full system compromise, affecting confidentiality, integrity, and availability of affected systems.

Red Hat has released an official security update that fixes this vulnerability by changing the default behavior of the ldap_sudo_search_base option in SSSD. Users should apply the updated sssd packages provided in Red Hat Enterprise Linux 10.2 or later. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigation is required once the update is applied.