The vulnerability CVE-2026-14476 affects the SSSD service in Red Hat Enterprise Linux 10. Specifically, the ad_gpo_extract_smb_components() function does not properly sanitize relative path sequences ('..') in the gPCFileSysPath LDAP attribute. An attacker with AD GPO management access can exploit this to write files outside the GPO cache directory with root privileges. This can be leveraged to inject malicious Kerberos configuration, resulting in authentication bypass on systems with default SELinux enforcing configurations. Red Hat has issued security advisories and updates to fix this issue by correcting the path sanitization in SSSD.

An attacker with Active Directory Group Policy management access can exploit this vulnerability to write arbitrary files as root outside the intended GPO cache directory. This can lead to Kerberos authentication bypass on default Red Hat Enterprise Linux 10 systems with SELinux enforcing, potentially allowing privilege escalation and unauthorized access.

Red Hat has released security updates for SSSD that address this vulnerability. Users should apply the official patches provided in Red Hat Security Advisories RHSA-2026:41937 and RHSA-2026:42122 to remediate the issue. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability; no additional immediate actions are required.