Red Hat Product Errata RHSA-2026:49841 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:49841 - Security Advisory Overview Updated Packages Synopsis Important: sssd security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 SRPM sssd-2.4.0-9.el8_4.5.src.rpm SHA-256: 89720fc18c5710f99dbfaab0545a10cd33ab2f8e8103d88be79958fa8660ddbd x86_64 libipa_hbac-2.4.0-9.el8_4.5.i686.rpm SHA-256: 49b22e9603aa68a7d86a902d0be0cbe1371de4c6827682af61c305069ee0ee8a libipa_hbac-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 0932cfc6f73726884dcc88f00e66995ac799d56b86a76c4438732fce51d9ac73 libipa_hbac-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 1611e4426b41f70b6762c1d74db76f60fdcb6d358556c40fe2c3e5eebf6151b6 libipa_hbac-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 2ff34afe9773b03a72d8534451040b2e0b28f99dd741bf69f58162f94bd4fde9 libsss_autofs-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: fcaaf34be844323a8677221644b29f255619e2b17c688745dcf9213d66eba09a libsss_autofs-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 02f912f5a9c0d659dd450bb90c9bedfa2d20777a46f1a43148270e00587561f9 libsss_autofs-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 2c92ffddad0981d58c30c5d9d8a64e2f82882bb0577f61267fe2596c486921ec libsss_certmap-2.4.0-9.el8_4.5.i686.rpm SHA-256: 911dc1d99be498308c4815b7f5903d48cb80ce10041af8537163c75726abdcd5 libsss_certmap-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 347ccb75d59dc488e3fd4a3cd076a9bce33d0322bd51e16a7ccebd5b3c9ccfa5 libsss_certmap-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: a843daa2a5ecd15ced75364eda829ffa60c9bac60ab18fd8035b43dc01cfff47 libsss_certmap-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 402a31ee46fd8d4ab1e83a1362dd7522f88fdf3386ecaddc3e2e30714f9f8e1a libsss_idmap-2.4.0-9.el8_4.5.i686.rpm SHA-256: 92b57966e6468a371b9502f552b772bb93137051403141a9a77c761feb5e6833 libsss_idmap-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 7d0a3539d5c5f857b5d56773f6f1cf4761e76ff46537f3fd874a4b00480bf03c libsss_idmap-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: c5ca70603cd38f24810dec858b3004385d22452be728e3407cf11eb77de99454 libsss_idmap-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 45b4c52980cdadd17fb80b78f89f01a19a4307e335044d278f58cf32d3ffe281 libsss_nss_idmap-2.4.0-9.el8_4.5.i686.rpm SHA-256: ea60d9a1d4458f426a2ef870a8a62b48fc6b8fc4e1d6ad9b2afd5fc1b57426cd libsss_nss_idmap-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: b0b088e680fdc6a7ad37c4fa599b7817154899da116be551bc65ea69a1b82868 libsss_nss_idmap-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: f2a27561307372f963e3e5db81f92f42171025eb665d88c9f4635ec12e3a2e30 libsss_nss_idmap-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 282cc6a9029ced57971c40d908cba899bef99d5828949bc86f3dd59d5aad830c libsss_simpleifp-2.4.0-9.el8_4.5.i686.rpm SHA-256: d7495f0c82def4ac83a806a658c849ceb8a4e52a5972f99df2533ee5494f051a libsss_simpleifp-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: d1a7ab634bc7d9978daa47fb9f814a774e82d220e1b21c714d75a4d6b11c823b libsss_simpleifp-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 212e03b7d08bf132b31d4b4c691392f69e222aac2a333329ad63af352745b92e libsss_simpleifp-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 8832d941b9b9987b93477b04af379f7aa7a7c89b36e61c04ec454dd7082f96bd libsss_sudo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 4a2bb5275630996eef588f6036126b362c07bf7e551d22cef4cb8385259e7ced libsss_sudo-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 5bcc3f57e8327df3fc883aeb12c4ebe542e985114540218ab8ab02c17c5a7dd0 libsss_sudo-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 8d4dc9682b1d2aba54040a19b6a4c159ba3cfcdaf006f9ed3b25050f0c0019a2 python3-libipa_hbac-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: aa61a00850f4c3cbd17b1f1dc8ceaac13fc48dbc6737d712e18081612a65cd61 python3-libipa_hbac-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 12340c37522b04aec612b88578347c76b21033818d8520949035847713aed257 python3-libipa_hbac-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 74cdec81845aab1b1f2c0241fd8d9de73c2a72f6e8902e632a90988819c77d7e python3-libsss_nss_idmap-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 3836de80f2cd167e1be5bc9aeef2299e67f9def0d0d78324916b8c2d08a8d1b4 python3-libsss_nss_idmap-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: fcb96ca1583a69f155bf2fee59e9b4dcf5cc99b0237bee05dad0e0aaf44e76a4 python3-libsss_nss_idmap-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 4bae1021a69773b7b8b3020a9d11612f3388c37db1fb57825ed8469aca364b45 python3-sss-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 91c4f974d8d4566b191a02a12aef8dd9494e230a094f93eafdf82edd38580a3f python3-sss-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 34154db19bcc2eea20856a95fffe7a62be0bdede50571198d0d838096233f15c python3-sss-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 624f7c92a2457d0e6ae1b26c03e0c4b29d59c5d4f1cdd838830d57d1e7fc2613 python3-sss-murmur-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: fe804960d70ba57eb96323fd28c6d378b222fe3c1944bfc099e41c92acf34ced python3-sss-murmur-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: d148206961a8fb052857706b3689c908e84a34f199af8002dbad81722eea31d0 python3-sss-murmur-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: a68107a446d8ad45ffb592a120fee1405df656b4149050f6fee8703c8cafd420 python3-sssdconfig-2.4.0-9.el8_4.5.noarch.rpm SHA-256: 1e428d3f8062fcf8dff80f600b70e6e8836d5c07b7f36cfb96043b95ea136e26 sssd-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 3dbbfa6b3098d9fcdf681b7eb0baa23d7b1c310391d7350bae3034e44593f5d0 sssd-ad-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 084205f067f78ed17126ec91745ad5e3d89b87817c306a666067e9d89a9ace62 sssd-ad-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 870e38cb2a828a606ae580424af45f09711c436e99f289275a9611cba9e9d5d4 sssd-ad-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 8b296e391bb2d423ee997912388919e19e3c9c5a31d58177acc4fad87f9cd311 sssd-client-2.4.0-9.el8_4.5.i686.rpm SHA-256: bf1e4dcacd4e45b85dd5b49deebe81bf7d6912639732dd7768b9f016398e28da sssd-client-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 0934a2c94519bf987b117a77ff44ac50f7e7a99b4638fbe264eb42185cdbab9b sssd-client-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 77d0f63cd27e3f40ea1649d21dca4786da7d2d42c0158d56beede259b37570f8 sssd-client-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 3fc1d01407b079337120e125420b379fd6678d3cdc0636d89673e4d28341ca46 sssd-common-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: bcdd9cd3a35f5e056a474dd50eb235980a4ac6905ff49bda27095e834a26058f sssd-common-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 175b6c1591da04a125b10c1164c5a838c87486527d37788e6a3f5e7285fa8e6a sssd-common-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: ea98bdf666e746dd8b328a697ce7e6e0fee443c4d0e7239f5a30f3411050059c sssd-common-pac-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 1f28fb511314ebbec75ca25b4087e7243ebea72a0fd9b232c1e9ac4f1b21df2a sssd-common-pac-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 9463ab8907dda9ed52f91683030711a5c4e1729f69ee5f33f7a667d6d16c031a sssd-common-pac-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 067cff94cceff459514048066da19f5af213ae0b7301d8299dcdce5832cdb217 sssd-dbus-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 6d3cc38b33b9773d4d1ad82487f2a60491fa76a5f59179425866423426fe9350 sssd-dbus-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 6dc636aaebd8c8e4e6dd43a74694dbf28e44ba0f1b68bbe0178a6b6fbc29ac4e sssd-dbus-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: e695498ae7672a0c77e97b00021f5a11f62233f8c6a558f603c3112012d1df4c sssd-debuginfo-2.4.0-9.el8_4.5.i686.rpm SHA-256: 522a28422e4a6d84a8d1f4df5a0e7a948f4ae1d89ddcf7def776747e5b6240f7 sssd-debuginfo-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 3b3a21af31da1772953111f804099210b71f83f1ae23d1b8793abd72e89c3424 sssd-debugsource-2.4.0-9.el8_4.5.i686.rpm SHA-256: df6d85f1a75f8a63b1eb70d27d10cc1bd21e0b437ac9a3cc42d3864f815cd15d sssd-debugsource-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: 7879e87aebea145dbf4a650a14221d0556341b1469668e67c69ae1c6e5f9f653 sssd-ipa-2.4.0-9.el8_4.5.x86_64.rpm SHA-256: cd772d13b7741266f03e2b917c041ab746660cd5100e202e9c769ea34c952b52 sssd-ipa-debuginfo-2.4.