Signal is active with 1 mentions in latest observed window
Immediate actions
Patch affected systems immediately
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
🚨 ALERTA: #openSUSE 2026-3139-1 corrige 2 falhas CRÍTICAS no SSSD (CVE-2026-14474 e CVE-2026-14476). Escalonamento de privilégio e bypass de autenticação podem comprometer TODOS os seus servidores. Saiba mais . -> http://tinyurl.com/3njc8jw3 https://t.co/nr1h3QCtKY
Post summary
OpenSUSE announces patch 2026-3139-1 to fix two critical SSSD vulnerabilities (CVE-2026-14474 & CVE-2026-14476) that could lead to privilege escalation and authentication bypass, urging users to apply the update.
🚨 HIGH - SSSD LDAP sudo provider default search base privilege escalation (CVE-2026-14474)
A flaw in SSSD’s LDAP sudo provider causes it to search the entire LDAP directory tree for sudoRole objects when ldap_sudo_search_base is not explicitly set. The root issue is insecure default configuration / improper scoping of LDAP searches, allowing sudo policy retrieval from unintended parts of the directory. An authenticated attacker with write access to any LDAP subtree can plant a crafted sudoRole entry that SSSD will discover and apply across enrolled systems. If exploited, this results in root-level sudo access on affected hosts, enabling full system compromise and lateral movement at scale.
👉 Affected: sssd, rhcos (SSSD LDAP sudo provider where ldap_sudo_search_base is unset) | Upgrade to vendor-fixed version (or set ldap_sudo_search_base explicitly until patched)
Post summary
A flaw in SSSD’s LDAP sudo provider allows authenticated attackers with LDAP write access to deploy sudoRole entries, granting root‑level sudo and full system compromise; the vendor recommends patching or setting ldap_sudo_search_base.
