Red Hat Product Errata RHSA-2026:46482 - Security Advisory Issued: 2026-07-27 Updated: 2026-07-27 RHSA-2026:46482 - Security Advisory Overview Updated Packages Synopsis Important: sssd security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM sssd-2.10.2-3.el10_0.5.src.rpm SHA-256: 9d3cff454837e5ca025d7ec3684d6e5e85cb930c6934c11afb164458135a571d x86_64 libipa_hbac-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: ce1039fa3dd882e24c3780b90ee23831cf199063a13a1e6f8f5b6e2c43c3e14c libipa_hbac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: bd6739e48f6478fa81a208a96b735381628b77636cc5c4e3fe30610f8de89b05 libipa_hbac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: bd6739e48f6478fa81a208a96b735381628b77636cc5c4e3fe30610f8de89b05 libsss_autofs-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: d67de7a1e2b8facc1edf90588f06b1eb2285d5e04ba123f583a35e649b670e2e libsss_autofs-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 0e2ad5683aba8eec28b50152b9c185cf9acde5a4be4d99f57b6fd0081be75dad libsss_autofs-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 0e2ad5683aba8eec28b50152b9c185cf9acde5a4be4d99f57b6fd0081be75dad libsss_certmap-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 82eb646748c2e51e0d898a95754a62a447b216a17f7c05a1a9ea1f2151cf17bf libsss_certmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 5017ac3ad54840d543a42a38ccc54858bdb1efadf25274d4401c2f639834e8cc libsss_certmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 5017ac3ad54840d543a42a38ccc54858bdb1efadf25274d4401c2f639834e8cc libsss_idmap-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 719cee1f9d334fc8d3821633334c33d6bfefce064430801ac8de58e6d372722c libsss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 31b51fab729565f9562f5ad5ada5094ac6a6b8e5f4283bbcced60cce42010661 libsss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 31b51fab729565f9562f5ad5ada5094ac6a6b8e5f4283bbcced60cce42010661 libsss_nss_idmap-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 7e78dc3e0dd18693ac16728f5de60e2f93b1fad1bc5cd982460a1aff78dd0081 libsss_nss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 6a925d806d45f01bbcc98ba438aeddfc63443d16de6be9301d5dc415fd5b2045 libsss_nss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 6a925d806d45f01bbcc98ba438aeddfc63443d16de6be9301d5dc415fd5b2045 libsss_sudo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: a950cf34659446d680f1234daaf92fa0d523ab75830adefcdfd80d7508d99db1 libsss_sudo-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 3307d43a97cbfa8065f1938abf6a2d8f35d7386e252e8f52c113646b94816dfb libsss_sudo-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 3307d43a97cbfa8065f1938abf6a2d8f35d7386e252e8f52c113646b94816dfb python3-libipa_hbac-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: a35c1f5c41eb4c7d8f395331fcb2c6fd65ecf7703d9c5d873cca0b7317c20ada python3-libipa_hbac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 7980ca7c809aba7246c6c9e7e5d41f86c88f2503ee67125bd5f9c75e90cf9239 python3-libipa_hbac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 7980ca7c809aba7246c6c9e7e5d41f86c88f2503ee67125bd5f9c75e90cf9239 python3-libsss_nss_idmap-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 1f1f6903b759a94429ad4f5ce054dacfdb146c9274c612a1c53172a163d2a696 python3-libsss_nss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 779e1f6f3c5b9c5735aa2d6b2c23bd48a533ca185de61f76d8f6c19e8fa20882 python3-libsss_nss_idmap-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 779e1f6f3c5b9c5735aa2d6b2c23bd48a533ca185de61f76d8f6c19e8fa20882 python3-sss-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e3bca87144dbb085e3ae44acc9173021500f5cc17007534a8174f63435bff1e1 python3-sss-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 50fccbf36773a992b80eeda1442ab26775297e42a5db41ab748a256ef0da9e73 python3-sss-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 50fccbf36773a992b80eeda1442ab26775297e42a5db41ab748a256ef0da9e73 python3-sss-murmur-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 1a2377e04d3bbf185a2779eba8ed24a6c442890c48bd23c4f3a273dae9d58fc7 python3-sss-murmur-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e7b32629731c19b6568481e37c71f98866f6264beb18a9bb2dbf8a4141a1cb02 python3-sss-murmur-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e7b32629731c19b6568481e37c71f98866f6264beb18a9bb2dbf8a4141a1cb02 python3-sssdconfig-2.10.2-3.el10_0.5.noarch.rpm SHA-256: da5fd94f555d54541bb0adb6a0452f390fe06ff6bf2ca4d9330c50afd7314bf3 sssd-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e3dfadd940b542fdae137a66b64adb93a940b1516bc451cddc5aa598556db4a9 sssd-ad-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 3789c289fbd2c0498f61784129c83011326b932fd593aa89c70be44dd7ae5115 sssd-ad-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e822dfffb5247a123b3f6c58b1f81782669d14f0a03b7de923889e80f0bd5aee sssd-ad-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: e822dfffb5247a123b3f6c58b1f81782669d14f0a03b7de923889e80f0bd5aee sssd-client-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 5ee97e39eb8d50e374cde8243ac6a10e2df2b741dc940cf76b0d917161781557 sssd-client-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 7df8608a378db9c723ee994493c7c325da75ec93110c059b2a37097a4344ccaf sssd-client-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 7df8608a378db9c723ee994493c7c325da75ec93110c059b2a37097a4344ccaf sssd-common-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: d555471366f404691a00da4d9301586ee096f729ce19ac6ea32b08e42fef175a sssd-common-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 204b65403c2d381e8f729d4d122ec9c458c685e9f3e9ad344217307ec13837b2 sssd-common-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 204b65403c2d381e8f729d4d122ec9c458c685e9f3e9ad344217307ec13837b2 sssd-common-pac-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: c5af17f032ef2cec2c21ce150a0e543d1284f0e86aa3c7aaa2b68cb0f23cce89 sssd-common-pac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 52470201876dfa1fffd2ff4a12476b3506c26e557999d519777630b7872b798f sssd-common-pac-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 52470201876dfa1fffd2ff4a12476b3506c26e557999d519777630b7872b798f sssd-dbus-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 8619609f8d1e51931e7ebdeca36ecfdfb61e96119e85d2a9a23a18707cb23111 sssd-dbus-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2549ec58f773648e131ec7196798c6ec76ed4dd8a1573fcb961a5f3027a138cd sssd-dbus-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2549ec58f773648e131ec7196798c6ec76ed4dd8a1573fcb961a5f3027a138cd sssd-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2adfb17a03432d8436169fd198383f9220ca4e67679146522c2530d123a679bc sssd-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2adfb17a03432d8436169fd198383f9220ca4e67679146522c2530d123a679bc sssd-debugsource-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: b7438a8d4c1d7c08d75cce71019ab31e5e6f4b5235169753508339c18cec9b46 sssd-debugsource-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: b7438a8d4c1d7c08d75cce71019ab31e5e6f4b5235169753508339c18cec9b46 sssd-idp-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 693f7dce2e2ed83a05302975b3062ad23bf3fd2cab1edb4bd8dec13c12775882 sssd-idp-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2ef02ddb9868cb4b246de50e271da5c7b6f465c6cfd23325309ff64abcb38be1 sssd-idp-debuginfo-2.10.2-3.el10_0.5.x86_64.rpm SHA-256: 2ef02ddb9868cb4b2