Path Traversal in SSSD AD GPO Provider Enables Root File Write

CVE-2026-14476 is a critical path traversal vulnerability in SSSD's Active Directory GPO (Group Policy Object) provider that allows attackers with AD GPO management privileges to write arbitrary files as root outside the intended GPO cache directory. The flaw stems from insufficient sanitization of directory traversal sequences (..) in the gPCFileSysPath LDAP attribute within the ad_gpo_extract_smb_components() function. This matters significantly because GPO management is often delegated to mid-level administrators, and the vulnerability can be weaponized to inject malicious Kerberos configurations that bypass authentication mechanisms—particularly on default RHEL deployments with SELinux enforcing mode. Any organization using SSSD for AD integration, especially in enterprise Linux environments, faces exposure to privilege escalation and authentication bypass attacks.

While CVE-2026-14476 does not map to explicit MITRE ATT&CK techniques, Casky's security skills powered by Claude AI would detect attack patterns associated with CWE-23 (path traversal) through analysis of LDAP attribute manipulation, suspicious file system operations outside expected directories, and anomalous Kerberos configuration changes. Practitioners using Casky would observe detection signals around: (1) abnormal LDAP queries targeting gPCFileSysPath attributes with traversal sequences, (2) SSSD process writes to system directories like /etc/krb5.conf outside normal update patterns, and (3) authentication failures or unexpected Kerberos realm redirections following GPO synchronization events. These findings would correlate with privilege escalation indicators (T1548) and credential access techniques (T1110), enabling defenders to identify compromise attempts before authentication bypass succeeds.