Red Hat Product Errata RHSA-2026:49844 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:49844 - Security Advisory Overview Updated Packages Synopsis Important: sssd security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64 Red Hat Enterprise Linux Server - AUS 8.6 x86_64 Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 SRPM sssd-2.6.2-4.el8_6.5.src.rpm SHA-256: 8dfde814af1c9990a20adb10226a67dfe76a37aea489fd5b6e83e07712831f32 x86_64 libipa_hbac-2.6.2-4.el8_6.5.i686.rpm SHA-256: ee2f2ea7c34e17cbf6b55178b322501443461af5ca1706a76a7c84ff92d5aea8 libipa_hbac-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: df215c52dd65711047bead6f465ce9f677504efc2e0ba8452585e4a3a9281f16 libipa_hbac-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 28cc2b8224e6ab6bc69682daafba2c067f148de7c73a3fe3a7c407383ded8bea libipa_hbac-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: cc28854419e76ec9bb0e352ea3aabce45ae5e0b464577381cd8cfb64d049cb79 libsss_autofs-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 563ed52eed67b9c27ed749c5874c6987bea5b190c7d018631b05b591520a814f libsss_autofs-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: c5805b1c0122482c2135840a10e218adc0c3709ca54da525d19cab859230baff libsss_autofs-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 71171bd1367513fa1f23a87c226c859eec79803868817ccc6b675c36e8b88e8c libsss_certmap-2.6.2-4.el8_6.5.i686.rpm SHA-256: 2571a68ce406dabeacff309d2e9270a54e09805b5fd7324f75ab09968a98bb45 libsss_certmap-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: c6f0c4cc1dff018412cd91316f4a8f9d41b3bb6a773f7c262dcceda3d0fe4141 libsss_certmap-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 6a86e09920f077e7041f8dae6eeaa28c856cee38774a0f3712ee90cd98e45f56 libsss_certmap-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 231aa2e639b4342b86c69819d7382a6fe96a25beea289619c4dbc6408b92eae4 libsss_idmap-2.6.2-4.el8_6.5.i686.rpm SHA-256: fd3fc584d04b6a5f0d92fdb242ce8522f82838e4f25ae4c0fc605be83217a711 libsss_idmap-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 2b979cdd60251f57be4054c8a5265859b3883613f29e381d5befc58602a8f6a6 libsss_idmap-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: b6beb533a3e44e27e2feae21b4191c789260a2c803710709b18f0f98c28b1f7a libsss_idmap-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 177697bbed5a2ca16331166f6d62c4ce5a8bbd8ac57a391de353fc9e6542ed7d libsss_nss_idmap-2.6.2-4.el8_6.5.i686.rpm SHA-256: b50c2e486ce9cae46f3ff969b5d3e28139a1f92314a17ae6a6adcfaf5442bc50 libsss_nss_idmap-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 548ab92381fca250942aa60d5ed4d14b2595dec3ff9dfa22c1399df746c7832c libsss_nss_idmap-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 164b20f4000036d24b8d03aea5b0091366144525bec5751aec3adcc63eb91765 libsss_nss_idmap-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 463046c2cc2b5388d9d8c1e74e0160d243ccc956e5336ceb62400e09eb7eceba libsss_simpleifp-2.6.2-4.el8_6.5.i686.rpm SHA-256: 7231b2bd46af8aab0a7349e24586dbf48921e763bf8c1f7b59b567ec6bc7079a libsss_simpleifp-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 4db769eb0f45a280f0f41054bf93e9c7b325dfaa713d975f8ba4d7a54cddf9ee libsss_simpleifp-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: e5b60d5c6a0e21e8d303470462acb415908815adb0c88c03abdcada7193eb790 libsss_simpleifp-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 16517fd76e4cf07e78fc126b6aae7edeeda6826be9ed8875e5da35d88a86c5fb libsss_sudo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 5fa14e7b66d7b6ffc92450ff5faa79b119bf93588c6fc9cd9d19d01bbff88ca7 libsss_sudo-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: f5c6d49ef6483891d846eb0270d7522174017709811913cc9b04accd5526856c libsss_sudo-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: ced59f6da39355d0886d0bcfc82c266c4ecbf984d673869be3a95a6ee4aa579c python3-libipa_hbac-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 8ef9b964d354ad0f1c0180c2c149f1dcd770f73896822ba4ff81cba93539d9cf python3-libipa_hbac-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 19c75264cc15bd48be5bb925aee5dbe53ff9920ffeb48693e9bb7d55e60f767a python3-libipa_hbac-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: f7056da52dc2be1b8a848a670d15682124c19f7a30644d68b854f85fc00298a5 python3-libsss_nss_idmap-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 8d27e49944e97c72211b7688226c2b19c84350c801262aa59d1579049c228709 python3-libsss_nss_idmap-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 255ce75113d3c7ab2e834b40daf3e9e2b53809e0ce6c4d1947e9c69dd2aaa567 python3-libsss_nss_idmap-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: db83ece2455af593bd7eb15ca578755d6c69b9e4da5ea53a9ba481e586568a60 python3-sss-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 0d73aefb8ee16d6eb731f7542e9c96d2de382c6488349b99a36b85fe2aac6d7c python3-sss-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 22fcf0aae56429b0ef5f9ed997133c353ee3e96432678c7855526f5506c22e63 python3-sss-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: fcdf5f41e3812bfef65d5ded97b4e9e338df22774b70d12880c1124d862de440 python3-sss-murmur-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: dae329a8dc486eecd4496b999b0d343df215fc9a3e037ae4dcab3d048cee6450 python3-sss-murmur-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: e0c1dc5c9717eba04572428c835268a477a80e141137ec2fe7517e0e848cc6bc python3-sss-murmur-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: c08d387bb35775c6c0bfa712ab9463f9038a3a3cedd9e18b56b0a00bd0311e21 python3-sssdconfig-2.6.2-4.el8_6.5.noarch.rpm SHA-256: dd91bef690af9d690fc331e1b6a34c2381a0572c5d9685498329fe5c128ae4ad sssd-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 7b4895523eede43b4df5bf1466ad52ef459f366bc1e8286982ffb33395c23902 sssd-ad-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 4f42ff05b24a3d26602229c95502d086dbaa62e57f32aaa4ed15e81cc6a3e80a sssd-ad-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: d4fcca1b3961b826da1e2ca84b469e9c41f0a6d7000f7767f1d1f1ad7616be2f sssd-ad-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 6cdfb31fc853eb6ae1e8134033fd4f08ace31659143f01b9e20a521364f15c2b sssd-client-2.6.2-4.el8_6.5.i686.rpm SHA-256: f30e560dcdf1596b148cb0300f0ebc9c658446c3ef9b6ab0a3b34b4e00844e8e sssd-client-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 816cf6a9295962b406c68b9b4ea1663f8adfe9141c3914ac6da1351d946c5ab1 sssd-client-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: e0386634e1abcc26acde6a92e06aa82a480ca1a305c8da690028ea0fd45d90a7 sssd-client-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: a8a1cd89beaa573838970ed3bf3a4c3d1c33bb76286089c2850967b3cb6b8e41 sssd-common-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 7c30d09706318405e3344876d4b626a00e153aef68e35ea7a3bfc09ea3a114b5 sssd-common-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 1ab9b0bdc54cc44786824aa3a6453a7d418e168dbbc185f15a79c40826c6e585 sssd-common-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: a1dc3d9644ec88159070f3965fc28adcd0606ee17331de8394938aa38e4ee411 sssd-common-pac-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 3f29bac83eec704e9ea6829c6eb134b6e403ed7bfce8570d5d2f73615ac9cc96 sssd-common-pac-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: d3e7a52e9bfea2d884d4b8bb5a12a7b6ee34360ff3b55710da3332a6d539ebc6 sssd-common-pac-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 23695185415ff0247728a12d709fab2b606286504e4fbb9976eb2028713b2571 sssd-dbus-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 113903f41a7168629f15ea5060083482513a970f9ae5a8d349cf242cf92f703c sssd-dbus-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: 0f1e985fa2cc63bf7a01433da74735d9eb1141614d838a437da20bc75be0ed1c sssd-dbus-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 89952598c16dbadee960fadffa2f0131f128a6ef972897b568377fa893bf468b sssd-debuginfo-2.6.2-4.el8_6.5.i686.rpm SHA-256: adad474ea203d16bf8fa76958a8aa9198b82df147cda9e148827953ae0cd26bb sssd-debuginfo-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: 8552ba079019b07708abe9168986f84ef5d210260a5f265123ebae5c1e559ec9 sssd-debugsource-2.6.2-4.el8_6.5.i686.rpm SHA-256: bb5b1b07df2ae5b2b8847cf2096e159b245fb0266bf550bacbf8f8c895aa4c8b sssd-debugsource-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: d58ccbc19cb761fe2f88f40fb07a6df2f3dd16bc36a23eda99c397758c0f9216 sssd-ipa-2.6.2-4.el8_6.5.x86_64.rpm SHA-256: dfaa6ad002939a8a007b463e2fec731536aeb530978d1a99a55338cbab79037a sssd-ipa-debuginfo-2.6.