VDB

RHSA-2026:50109

RHSA-2026:50109 PUBLISHED CVSS 8 HIGH

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Risk Scores

CVSS 3.1
8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatlibsss_simpleifp-0:1.16.5-10.el7_9.18.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatlibipa_hbac-0:1.16.5-10.el7_9.18.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-0:1.16.5-10.el7_9.18.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-polkit-rules-0:1.16.5-10.el7_9.18.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatpython-sssdconfig-0:1.16.5-10.el7_9.18.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-tools-0:1.16.5-10.el7_9.18.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatpython-libipa_hbac-0:1.16.5-10.el7_9.18.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatlibsss_idmap-devel-0:1.16.5-10.el7_9.18.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-0:1.16.5-10.el7_9.18.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-tools-0:1.16.5-10.el7_9.18.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatlibsss_idmap-devel-0:1.16.5-10.el7_9.18.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-polkit-rules-0:1.16.5-10.el7_9.18.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-debuginfo-0:1.16.5-10.el7_9.18.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatlibsss_certmap-0:1.16.5-10.el7_9.18.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-debuginfo-0:1.16.5-10.el7_9.18.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-libwbclient-devel-0:1.16.5-10.el7_9.18.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-client-0:1.16.5-10.el7_9.18.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-krb5-0:1.16.5-10.el7_9.18.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-debuginfo-0:1.16.5-10.el7_9.18.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)0:1.16.5-10.el7_9.18
Red Hatsssd-common-pac-0:1.16.5-10.el7_9.18.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)0:1.16.5-10.el7_9.18

…and 164 more

Timeline

  • Aug 4, 2026 CVE Published
  • Aug 12, 2026 CVE Updated
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 12, 2026 Security Advisory
  • Aug 12, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›