CVE-2026-59681: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in SUSE yast2-auth-client

This vulnerability exists in the Auth::AuthConf component of yast2-auth-client, specifically in src/lib/auth/authconf.rb. The code assembles Samba commands (net ads join, net ads lookup -S, net ads testjoin) by interpolating Active Directory configuration values such as Organizational Unit (ou), dnshostname, AD user name, and AD domain name into a single command string. This string is then passed to Ruby's Open3.popen2/Open3.capture2, which executes it through /bin/sh. Because these input values are neither validated nor shell-quoted, an attacker controlling them can inject arbitrary OS commands executed with root privileges.

Successful exploitation allows an attacker with control over Active Directory configuration values to execute arbitrary commands as root on the host running yast2-auth-client. This can lead to full system compromise, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for Active Directory configuration values in yast2-auth-client. Monitor SUSE advisories for updates and apply patches promptly once released.