Name: CVE-2026-14474: Initialization of a Resource with an Insecure Default
Creator: Rapid7
Published: 2026-07-07T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-14474, CWE-1188, CVSS 8.8, EPSS 0.00568

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

CVSS Details

CVSS 3.1 Base Score: 8.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade libsss_idmapUpgrade libsss_sudoUpgrade sssd-ipaUpgrade sssd-winbind-idmapUpgrade sssd-toolsUpgrade libsss_nss_idmapUpgrade python3-libsss_nss_idmapUpgrade sssdUpgrade sssd-krb5-commonUpgrade sssd-adUpgrade libsss_simpleifpUpgrade python3-libipa_hbacUpgrade sssd-nfs-idmapUpgrade sssd-proxyUpgrade libipa_hbacUpgrade python3-sssdconfigUpgrade libsss_autofsUpgrade sssd-dbusUpgrade sssd-ldapUpgrade sssd-commonUpgrade sssd-polkit-rulesUpgrade python3-sss-murmurUpgrade libsss_nss_idmap-develUpgrade sssd-idpUpgrade python3-sssUpgrade sssd-clientUpgrade sssd-kcmUpgrade sssd-common-pacUpgrade libsss_certmapUpgrade sssd-krb5	Jul 26, 2026	Jul 20, 2026
Amazon Linux Ami 2	—	Upgrade sssd-krb5Upgrade libsss_certmap-develUpgrade libsss_autofsUpgrade libsss_simpleifpUpgrade libsss_certmapUpgrade sssdUpgrade libsss_simpleifp-develUpgrade sssd-ldapUpgrade sssd-libwbclient-develUpgrade sssd-clientUpgrade sssd-common-pacUpgrade libipa_hbac-develUpgrade python-sss-murmurUpgrade libsss_sudoUpgrade python-sssUpgrade sssd-krb5-commonUpgrade sssd-winbind-idmapUpgrade sssd-dbusUpgrade sssd-proxyUpgrade sssd-kcmUpgrade libsss_idmap-develUpgrade libsss_nss_idmap-develUpgrade sssd-polkit-rulesUpgrade sssd-ipaUpgrade sssd-debuginfoUpgrade python-libsss_nss_idmapUpgrade libsss_idmapUpgrade sssd-adUpgrade sssd-toolsUpgrade sssd-libwbclientUpgrade libsss_nss_idmapUpgrade libipa_hbacUpgrade python-sssdconfigUpgrade sssd-commonUpgrade python-libipa_hbac	Aug 5, 2026	Aug 5, 2026
Redhat Openshift	—	Upgrade ose-rhel-coreos	Aug 19, 2026	Jul 7, 2026
Redhat_linux	—	Upgrade sssd-krb5-debuginfoUpgrade libsss_certmap-develUpgrade sssd-passkey-debuginfoUpgrade libsss_certmap-debuginfoUpgrade python-libipa_hbacUpgrade python-sss-murmurUpgrade sssd-ad-debuginfoUpgrade sssd-krb5-commonUpgrade sssd-idpUpgrade python3-sss-murmur-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-krb5-common-debuginfoUpgrade libsss_certmapUpgrade sssd-idp-debuginfoUpgrade python-libsss_nss_idmapUpgrade libipa_hbacUpgrade sssd-ldap-debuginfoNo solution existsUpgrade libsss_autofs-debuginfoUpgrade sssd-common-pacUpgrade sssd-client-debuginfoUpgrade python3-sssUpgrade sssd-dbus-debuginfoUpgrade python3-sssdconfigUpgrade sssdUpgrade sssd-kcmUpgrade python3-libipa_hbac-debuginfoUpgrade libsss_sudoUpgrade libipa_hbac-develUpgrade libipa_hbac-debuginfoUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-ipaUpgrade libsss_sudo-debuginfoUpgrade python-sssdconfigUpgrade sssd-dbusUpgrade libsss_idmap-develUpgrade sssd-adUpgrade libsss_simpleifp-debuginfoUpgrade libsss_nss_idmapUpgrade python3-sss-murmurUpgrade libsss_simpleifp-develUpgrade libsss_nss_idmap-develUpgrade python-sssUpgrade python3-libsss_nss_idmap-debuginfoUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-commonUpgrade sssd-ldapUpgrade sssd-libwbclientUpgrade sssd-ipa-debuginfoUpgrade sssd-tools-debuginfoUpgrade python3-libipa_hbacUpgrade libsss_idmap-debuginfoUpgrade python3-libsss_nss_idmapUpgrade sssd-clientUpgrade sssd-proxy-debuginfoUpgrade libsss_simpleifpUpgrade sssd-libwbclient-develUpgrade libsss_idmapUpgrade sssd-passkeyUpgrade sssd-toolsUpgrade python3-sss-debuginfoUpgrade sssd-debugsourceUpgrade sssd-kcm-debuginfoUpgrade sssd-proxyUpgrade sssd-winbind-idmap-debuginfoUpgrade libsss_autofsUpgrade sssd-winbind-idmapUpgrade sssd-common-pac-debuginfoUpgrade sssd-nfs-idmapUpgrade sssd-debuginfoUpgrade sssd-common-debuginfoUpgrade sssd-krb5	Jul 17, 2026	Jul 7, 2026
Rocky_linux	—	Upgrade sssd-winbind-idmap-debuginfoUpgrade libsss_simpleifpUpgrade libsss_simpleifp-debuginfoUpgrade python3-libsss_nss_idmapUpgrade sssd-krb5-common-debuginfoUpgrade sssd-common-debuginfoUpgrade sssd-ldapUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_sudoUpgrade libipa_hbacUpgrade sssd-toolsUpgrade libsss_sudo-debuginfoUpgrade sssd-client-debuginfoUpgrade sssd-commonUpgrade python3-sss-debuginfoUpgrade sssd-common-pac-debuginfoUpgrade sssd-ipa-debuginfoUpgrade sssd-proxyUpgrade libsss_idmap-debuginfoUpgrade sssd-debuginfoUpgrade sssdUpgrade sssd-debugsourceUpgrade sssd-winbind-idmapUpgrade sssd-ipaUpgrade libsss_nss_idmapUpgrade sssd-tools-debuginfoUpgrade libsss_autofsUpgrade libsss_idmap-develUpgrade python3-libipa_hbacUpgrade sssd-nfs-idmapUpgrade libsss_idmapUpgrade sssd-passkeyUpgrade python3-sss-murmur-debuginfoUpgrade sssd-adUpgrade sssd-ad-debuginfoUpgrade sssd-ldap-debuginfoUpgrade sssd-idp-debuginfoUpgrade sssd-idpUpgrade sssd-common-pacUpgrade sssd-dbus-debuginfoUpgrade libsss_autofs-debuginfoUpgrade sssd-passkey-debuginfoUpgrade python3-sss-murmurUpgrade libsss_nss_idmap-debuginfoUpgrade python3-sssUpgrade python3-libipa_hbac-debuginfoUpgrade libsss_certmapUpgrade sssd-kcm-debuginfoUpgrade sssd-polkit-rulesUpgrade sssd-krb5-debuginfoUpgrade sssd-kcmUpgrade libsss_certmap-debuginfoUpgrade sssd-clientUpgrade libsss_nss_idmap-develUpgrade libsss_certmap-develUpgrade sssd-nfs-idmap-debuginfoUpgrade libipa_hbac-debuginfoUpgrade sssd-krb5-commonUpgrade sssd-proxy-debuginfoUpgrade sssd-dbusUpgrade sssd-krb5	Jul 27, 2026	Jul 22, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence