Red Hat Product Errata RHSA-2026:50109 - Security Advisory Issued: 2026-08-04 Updated: 2026-08-04 RHSA-2026:50109 - Security Advisory Overview Updated Packages Synopsis Important: sssd security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM sssd-1.16.5-10.el7_9.18.src.rpm SHA-256: 27af0a96c7844bf27cdf7d318b9177ad0267c313f17143070e9494ecd0d94ae9 x86_64 libipa_hbac-1.16.5-10.el7_9.18.i686.rpm SHA-256: ae3434ef9ff9b8efb45ba665b9189805312a7c6ea45d8be319ad33da2b11eb2e libipa_hbac-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 565b864c4e49d863dc0895a7a70ee4d694cc4b9c229b546b840cad9b5debdc8b libipa_hbac-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: 32623c3faa60c5a086f0fef4db0a9f15648bd38eef19ce6ab6e1e31c0466253d libipa_hbac-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: b6fb533ed7d89c5038e2a4ad2e08c1e079d9e2b526edec2dd4759b9049f14fb6 libsss_autofs-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: c4b40f7bae187dbb806c2d41ca51af84c301a37a1430a6988e37242e361d3de1 libsss_certmap-1.16.5-10.el7_9.18.i686.rpm SHA-256: 9d4436ee81ee84bf88b80e3da53678ca053380c43604e4fdc517107e31ecfe51 libsss_certmap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: dc796d4e1bd342cdb685f07d160d09963ccd897e7ce42a6b2bc14f68d7399540 libsss_certmap-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: 178d25b8fc42666ce39354936440474bdcddc271e95137aca5c4d66f7b5037c0 libsss_certmap-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 239c3e33e33b4680225dae5049ad35ac6a9a6d071d9912e9d3c02f4b218038fc libsss_idmap-1.16.5-10.el7_9.18.i686.rpm SHA-256: 3ae2a14981e2d3dde865beb7e1426c393749eed53d8bca8425c6ff0fc083ace7 libsss_idmap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 44f2976cabf9e48e67910d5e274a8d58f6deeb43ca9480ed5d380c340bbc4859 libsss_idmap-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: a29ac879582256b5be26cda2fb0a26ad3a820e6849b7607389867adb81e8bfa2 libsss_idmap-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: b0e20bf50ea41014bf1a29adafadb7f98a8c776d680d7f09606bf9cd8a538785 libsss_nss_idmap-1.16.5-10.el7_9.18.i686.rpm SHA-256: 517a4f2b0e5c7a8dac9a82618c54b24c317ea3197806d0a2992c019d8e26a051 libsss_nss_idmap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 8f40dd28c5c48f6043b086761aaaa783b079ca1edb55e8ca3f059334f7104a5e libsss_nss_idmap-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: 7d5b3ca4f9a9a5ea165c00ec201d55afa1e633b6a7de66a007f5ecc6d9c46174 libsss_nss_idmap-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: a5dd9d7d69fb68ed06e4bd5cf81648f3b7175ceac24b81b7221e8963c1b158c1 libsss_simpleifp-1.16.5-10.el7_9.18.i686.rpm SHA-256: 9f024d07a6389758aa7d27a05fc25de5571422df37980631a36d00f656697bb5 libsss_simpleifp-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 5bdd9eda1ef539f710cc1a10cbad126f05357de0f687642c18fbc62e410f79c2 libsss_simpleifp-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: 6635b6ce25af3b59b2576a8336fb16599710354d1aa29730bba88041436da109 libsss_simpleifp-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 99f9d04b8934a5069b3753607ece34ba0dd1972963a3297ee5e149cedf4bbcc2 libsss_sudo-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 9c5f2e36192f43c9d4b8d6e6ec7f26524deafb7bf6ebfde7376c13321d7f885e python-libipa_hbac-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 90316b008385d2ad3a855e5b42a82fce374ed4717ee6c3895338c843bc46084c python-libsss_nss_idmap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 74897d0f6d7b14557e1532873ca0eda1e73f6945ffc97514c03f404191a57a53 python-sss-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 71a0e76771cc664d95f00123faa4d5edb3ca8c1c4ea59ff4722cb9534908bfdc python-sss-murmur-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 92cf517970aec668822afd8a6bacaebd15ea249c35606489263049460e503a67 python-sssdconfig-1.16.5-10.el7_9.18.noarch.rpm SHA-256: e9477e5090bd8b07b55c1166bc0e831bf6962ae877cf1621aa37af1461dfc6cf sssd-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 291ce99ddc75abeac002f9f74434495538942ac49d140678ca06dd143481a868 sssd-ad-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 38b01867ec390051bf1654211d2b37fa50e93809470f80f6cc12a81031844dd1 sssd-client-1.16.5-10.el7_9.18.i686.rpm SHA-256: 830132ecbd76d464feb3d3106ef4eab872a2aa4a0255e1c78e83b230f0005e03 sssd-client-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 939b2f4c650462f638e11211efd10d49ade1db37951bf6954e8ac17662be6099 sssd-common-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: d1c6ea552687eea8c0a4fc2c3aac432704cb21fe358f7c4d2b15f44eca69137c sssd-common-pac-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 4c96290bc2ee371e054e81b9ee9552898f828d90d958130aab96ad402cd301b9 sssd-dbus-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 88473a3229a1f4b065bda982176ab39dd79cfe5ab4b65468a0e7a31676f86199 sssd-debuginfo-1.16.5-10.el7_9.18.i686.rpm SHA-256: b1d8845c3f0524fa0e81092d0efff2612cc2bf0ea835e88d378bc366d1bc3dce sssd-debuginfo-1.16.5-10.el7_9.18.i686.rpm SHA-256: b1d8845c3f0524fa0e81092d0efff2612cc2bf0ea835e88d378bc366d1bc3dce sssd-debuginfo-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 818d8571d5f3ad7712214309288f2b37bd95a9062edc29c713e716aa3354fa94 sssd-debuginfo-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 818d8571d5f3ad7712214309288f2b37bd95a9062edc29c713e716aa3354fa94 sssd-ipa-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 062fc5b34297419dd203440ebeb00b6147011a5231ce33bf48e048aead78f497 sssd-kcm-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 0cb89e35564b80d4be7a18ec87d37b4e989a45bcd9354d878f39ba9072644a92 sssd-krb5-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: dcc7b866814ea830aad9428cbffbbd8143d23ccff9b0137c8ed70d6c2664ed36 sssd-krb5-common-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 185c7dd37f1526b37f84d89938d7f9b4bf567ae6632dd01189551632b44f50e8 sssd-ldap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 00e8130a1d0728feda638ee75777a10a3d051155e2f2bfd7fb46b789babb9434 sssd-libwbclient-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 8925bd5d3a157320837fcdcc87e57e06c64f7cf8aa43a2d1fbf0ac0d170a2e1d sssd-libwbclient-devel-1.16.5-10.el7_9.18.i686.rpm SHA-256: fde6d0bfc181f55ead7b2e76572dd75ff97bb7aa1a9a5613632dedba13fa010a sssd-libwbclient-devel-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: daec4acd67a0088b2b4f58454bb641a9fbcb0aed9293710f01c4b2ed86f8ec6a sssd-polkit-rules-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 1e5c28a06a6068de445f6d97afb02487381d2543f343c6df5b9b56598416c975 sssd-proxy-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: c60bd4d1290a334c28f8b70edef65e1f0fddb2ab9ed8ba17db51cfd46a18b636 sssd-tools-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 7f82b6dbc492192a318c8b2fda89ba5a453accf0f7f5ea1f2819e00a5bea85c6 sssd-winbind-idmap-1.16.5-10.el7_9.18.x86_64.rpm SHA-256: 2a169282b812962cb38648a2da6bd5153ef28df9b646026287afae3778c0025f Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM sssd-1.16.5-10.el7_9.18.src.rpm SHA-256: 27af0a96c7844bf27cdf7d318b9177ad0267c313f17143070e9494ecd0d94ae9 s390x libipa_hbac-1.16.5-10.el7_9.18.s390.rpm SHA-256: f2e2327964340f66cc477ed5c7f6c7d1767f3524eeb0f375c584a186a9d5adcc libipa_hbac-1.16.5-10.el7_9.18.s390x.rpm SHA-256: f63a8abddcbd0eb488cd6e7f029c22dd288f3e5aef6438e507b23a7cfcb70561 libipa_hbac-devel-1.16.5-10.el7_9.18.s390.rpm SHA-256: 467fa5bfdbd1479ce59613f7725a1d193d48b960d3919caee9410b74d1d1fb87 libipa_hbac-devel-1.16.5-10.el7_9.18.s390x.rpm SHA-256: 2fcafa0ef8558b785f20cb25aef28d99a92559bc5be166029ea71645fdce6952 libsss_autofs-1.16.5-10.el7_9.18.s390x.rpm SHA-256: 261ed287662fedab9980f2aa492cf1e774890de344de4512dabf32a2c4041fdc libsss_certmap-1.16.5-10.el7_9.18.s390.rpm SHA-256: aa5c0b71fd756f80b0f59e5a412e058f59d606a030862c71b12fc10843e64337 libsss_certmap-1.16.5-10.el7_9.18.s390x.rpm SHA-256: 74138169f8053c1409651f8d7f22b05897c89e1f38c258e219834d22da9dd46f libsss_certmap-devel-1.16.5-10.el7_9.18.s390.rpm SHA-256: 25f641464a486598038b32c4e400af0bb3cb001a5c16f21649e41231671fe235 libsss_certmap-devel-1.16.5-10.el7_9.18.s390x.rpm SHA-256: 0c263a4ca382c56634a3a8d43ca16d42f0d9010b1cab5