Red Hat Product Errata RHSA-2026:46990 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:46990 - Security Advisory Overview Updated Packages Synopsis Important: sssd security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) Bug Fix(es) and Enhancement(s): sss_override does not work on AD UPN [rhel-8.10.z] (JIRA:RHEL-168363) [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z] (JIRA:RHEL-168415) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass RHEL-168415 - [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z] CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM sssd-2.9.4-5.el8_10.5.src.rpm SHA-256: e01332728a7b4206798b44fdd9575e5b34febe7c0922f39a78a04187e16ee8e6 x86_64 libipa_hbac-2.9.4-5.el8_10.5.i686.rpm SHA-256: ef9016d1d301aadb0ec84efbdfacbf97556456c669e6ca02b4702c4c054acea9 libipa_hbac-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 48fb9b4483aa6ddc750bac772c796e20c5e03379db9fa25346dbc63c0545f4c2 libipa_hbac-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 04b91658d55f07b92365e5b10d9eb733a6af5059e416a824ab0efb42bbd1c254 libipa_hbac-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 15f8e404cf09be2b6261f5ef9f80f3256b63656bfa6381cdf4245bee8b6ecb7f libipa_hbac-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 15f8e404cf09be2b6261f5ef9f80f3256b63656bfa6381cdf4245bee8b6ecb7f libsss_autofs-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 6540acea95094ff8fcd7faf7e93bd6ecf8fb1d286d066630b3fe27096a341ae3 libsss_autofs-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 2dc23f0593b72e96223191c052a10962afc769757d87f89c47cccc3ce69e5828 libsss_autofs-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: cd1743cef4bec7f3946e5d4de73b44210258e93a9d18bcd69b443983c04349e3 libsss_autofs-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: cd1743cef4bec7f3946e5d4de73b44210258e93a9d18bcd69b443983c04349e3 libsss_certmap-2.9.4-5.el8_10.5.i686.rpm SHA-256: 4ee87f0a67436d4d0b93ed4d700dea42590c693520cf703836e5ceafc4f63d34 libsss_certmap-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: c45178fe1410f685a51881bb25edb0b44cab6b2fe5cc6a8cd5f87146956530a1 libsss_certmap-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: e49eb8fd758d6d805f5d02aa59a35d50cb24c2c6705c77ac8f0aabb3ca2531f3 libsss_certmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 780b72ed253e0f6fc2d087ed4af5fcb6e6f00bd532c5beaff0592e075f9a3e98 libsss_certmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 780b72ed253e0f6fc2d087ed4af5fcb6e6f00bd532c5beaff0592e075f9a3e98 libsss_idmap-2.9.4-5.el8_10.5.i686.rpm SHA-256: bb3072f51dd7828dcf3e348bf597318ed1f964063ffe388e188a7862c4016307 libsss_idmap-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: bee83a8d069624870038161539f1d7e5381d1bdde511ee062ac5dbf0702d2ffb libsss_idmap-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 94d25f625fcb3ea6053d7841140119f907e8e525ecc0f0c0c95b24ddf3d172d7 libsss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 35ab8b8e60e7985d2d6d4d9248cba934be59f5d09c90888b72cd9db0f3cd6e23 libsss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 35ab8b8e60e7985d2d6d4d9248cba934be59f5d09c90888b72cd9db0f3cd6e23 libsss_nss_idmap-2.9.4-5.el8_10.5.i686.rpm SHA-256: c634677a5556b520983832f406c0f3d0901993370b8b2d1625eee4e72af53aee libsss_nss_idmap-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: d3f77982059645028ba6caf178056fab03063725643832266860e9c316ea6717 libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: a020b3af5939dff897502a3aa9b8d8225f1a963c67ad952c4abf3a55e6092cf2 libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 8d264183286a7e9e180159be1e64459d0610901cfebe74d8e7d6381a3ccd5b6d libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 8d264183286a7e9e180159be1e64459d0610901cfebe74d8e7d6381a3ccd5b6d libsss_simpleifp-2.9.4-5.el8_10.5.i686.rpm SHA-256: 0eae362b9335800982ad85c940a79b0b8a0b0c58008dc80fb92831c8a70ba5f9 libsss_simpleifp-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: fd6c61b2c10f786af04e5fd994aae941f73f7bf2c3cd33c00b333a26fa57d3c7 libsss_simpleifp-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 9078c3cd3c9fbd30c33a0e482d7ae32665304cedf981161b508a27799d0ca47b libsss_simpleifp-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: f20c03ed9bcd7de11b81d82f6d92851220d1e7b3cce2fc6ac9c7f409117cb9c4 libsss_simpleifp-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: f20c03ed9bcd7de11b81d82f6d92851220d1e7b3cce2fc6ac9c7f409117cb9c4 libsss_sudo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 6a35b419627c93588ff5eee38abcf2bf594ae5283f9c42d031d865bfe4280bb0 libsss_sudo-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: f7655f47c33d6c4a96d14ca75256d560ff44c009e68ba254f3d2fa2015a44f94 libsss_sudo-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: f55ff435b3d6bd76a98e361da705b3091a28e0c470a8dbdb5d7ecbba0bd9d8bf libsss_sudo-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: f55ff435b3d6bd76a98e361da705b3091a28e0c470a8dbdb5d7ecbba0bd9d8bf python3-libipa_hbac-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 2d2f7d8757a46aab16b37f2c486db48ffce3115e0eaf1311dfaae0b574611e02 python3-libipa_hbac-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 24184145d2efabb98270fc3ca555d5fa38281fb8770ad496e35a3a7e86baca00 python3-libipa_hbac-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 528dec745bff1f67a7a9097464e89aaa59f8be1848b57044c2ff75066508ea57 python3-libipa_hbac-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 528dec745bff1f67a7a9097464e89aaa59f8be1848b57044c2ff75066508ea57 python3-libsss_nss_idmap-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 4f196e0c4b0d1ec767eea3789b2b9a8991b121d4465c5f4312733b9678620d85 python3-libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: ef648387b70d995196d399cb4f361e47ae00a818768ca6a96e868867342193fb python3-libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 02440202f078572297da5a8571d46cba8b18f3bf657dc7394dedcaa40685cffb python3-libsss_nss_idmap-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 02440202f078572297da5a8571d46cba8b18f3bf657dc7394dedcaa40685cffb python3-sss-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 553baa5c41ea910831e141fe5c6b2052d75225cb1a6b3fb737e786dd6c01405b python3-sss-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 7a6f5eb39401a7b3e491a76ab30fa98a4776959f585a6596251e37be8cf40ebc python3-sss-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 42a75d7306656c44c2bad8955c19564c7ded72ecadd88fe589e40f39aadd6378 python3-sss-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 42a75d7306656c44c2bad8955c19564c7ded72ecadd88fe589e40f39aadd6378 python3-sss-murmur-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: dfd3e9ba5f68ff020049c09035b7c8c1aae82bf129062403115967729a26f37c python3-sss-murmur-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 011e394e89437043bfee607cc9647870291d9e8d10d3dbce58e988665ac9a17b python3-sss-murmur-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 21c493e1ef0b107985526d3ef8db4cd7e04cb6dc8650df5713321ab14cf56cad python3-sss-murmur-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 21c493e1ef0b107985526d3ef8db4cd7e04cb6dc8650df5713321ab14cf56cad python3-sssdconfig-2.9.4-5.el8_10.5.noarch.rpm SHA-256: 7779ade03a898a97b4ad4491f9006b50bf58eb8653a0860dcd5f03e594534a58 sssd-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 95e88d785e4bead28a05c479beffb979e58f6ba82b1b4558fa91929db0e9143c sssd-ad-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: b62ee3ba6d8e16b519f91b9a1d058cc9b4fe435296246866a1cca96971e26061 sssd-ad-debuginfo-2.9.4-5.el8_10.5.i686.rpm SHA-256: 51e22860fd72406fd93873fef131e1a0423034d58cb31f3873cbfdf5c5920216 sssd-ad-debuginfo-2.9.4-5.el8_10.5.x86_64.rpm SHA-256: 9f5cb