🛡️ ALSA-2026:46990 — libipa-hbac
Description
Important: sssd security, bug fix, and enhancement update
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.
Security Fix(es):
- sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)
- sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476)
Bug Fix(es) and Enhancement(s):
- sss_override does not work on AD UPN [almalinux-8.10.z] (JIRA:AlmaLinux-168363)
- [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [almalinux-8.10.z] (JIRA:AlmaLinux-168415)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
ALSA-2026:46990 is recorded against 30 packages.
- libipa-hbac (fixed in 2.9.4-5.el8_10.5)
- libsss-autofs (fixed in 2.9.4-5.el8_10.5)
- libsss-certmap (fixed in 2.9.4-5.el8_10.5)
- libsss-idmap (fixed in 2.9.4-5.el8_10.5)
- libsss-nss-idmap (fixed in 2.9.4-5.el8_10.5)
- libsss-nss-idmap-devel (fixed in 2.9.4-5.el8_10.5)
- libsss-simpleifp (fixed in 2.9.4-5.el8_10.5)
- libsss-sudo (fixed in 2.9.4-5.el8_10.5)
- python3-libipa-hbac (fixed in 2.9.4-5.el8_10.5)
- python3-libsss-nss-idmap (fixed in 2.9.4-5.el8_10.5)
- python3-sss (fixed in 2.9.4-5.el8_10.5)
- python3-sss-murmur (fixed in 2.9.4-5.el8_10.5)
- python3-sssdconfig (fixed in 2.9.4-5.el8_10.5)
- sssd (fixed in 2.9.4-5.el8_10.5)
- sssd-ad (fixed in 2.9.4-5.el8_10.5)
- sssd-client (fixed in 2.9.4-5.el8_10.5)
- sssd-common (fixed in 2.9.4-5.el8_10.5)
- sssd-common-pac (fixed in 2.9.4-5.el8_10.5)
- sssd-dbus (fixed in 2.9.4-5.el8_10.5)
- sssd-idp (fixed in 2.9.4-5.el8_10.5)
- sssd-ipa (fixed in 2.9.4-5.el8_10.5)
- sssd-kcm (fixed in 2.9.4-5.el8_10.5)
- sssd-krb5 (fixed in 2.9.4-5.el8_10.5)
- sssd-krb5-common (fixed in 2.9.4-5.el8_10.5)
Show the remaining 6 packages
- sssd-ldap (fixed in 2.9.4-5.el8_10.5)
- sssd-nfs-idmap (fixed in 2.9.4-5.el8_10.5)
- sssd-polkit-rules (fixed in 2.9.4-5.el8_10.5)
- sssd-proxy (fixed in 2.9.4-5.el8_10.5)
- sssd-tools (fixed in 2.9.4-5.el8_10.5)
- sssd-winbind-idmap (fixed in 2.9.4-5.el8_10.5)
Timeline and source
Published on 28 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
access.redhat.com (Advisory)
access.redhat.com (Report)
access.redhat.com (Report)
bugzilla.redhat.com (Report)
bugzilla.redhat.com (Report)
errata.almalinux.org (Advisory)
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| libipa-hbac | — | 2.9.4-5.el8_10.5 |
| libsss-autofs | — | 2.9.4-5.el8_10.5 |
| libsss-certmap | — | 2.9.4-5.el8_10.5 |
| libsss-idmap | — | 2.9.4-5.el8_10.5 |
| libsss-nss-idmap | — | 2.9.4-5.el8_10.5 |
| libsss-nss-idmap-devel | — | 2.9.4-5.el8_10.5 |
| libsss-simpleifp | — | 2.9.4-5.el8_10.5 |
| libsss-sudo | — | 2.9.4-5.el8_10.5 |
| python3-libipa-hbac | — | 2.9.4-5.el8_10.5 |
| python3-libsss-nss-idmap | — | 2.9.4-5.el8_10.5 |
| python3-sss | — | 2.9.4-5.el8_10.5 |
| python3-sss-murmur | — | 2.9.4-5.el8_10.5 |
| python3-sssdconfig | — | 2.9.4-5.el8_10.5 |
| sssd | — | 2.9.4-5.el8_10.5 |
| sssd-ad | — | 2.9.4-5.el8_10.5 |
| sssd-client | — | 2.9.4-5.el8_10.5 |
| sssd-common | — | 2.9.4-5.el8_10.5 |
| sssd-common-pac | — | 2.9.4-5.el8_10.5 |
| sssd-dbus | — | 2.9.4-5.el8_10.5 |
| sssd-idp | — | 2.9.4-5.el8_10.5 |
| sssd-ipa | — | 2.9.4-5.el8_10.5 |
| sssd-kcm | — | 2.9.4-5.el8_10.5 |
| sssd-krb5 | — | 2.9.4-5.el8_10.5 |
| sssd-krb5-common | — | 2.9.4-5.el8_10.5 |
| sssd-ldap | — | 2.9.4-5.el8_10.5 |
| sssd-nfs-idmap | — | 2.9.4-5.el8_10.5 |
| sssd-polkit-rules | — | 2.9.4-5.el8_10.5 |
| sssd-proxy | — | 2.9.4-5.el8_10.5 |
| sssd-tools | — | 2.9.4-5.el8_10.5 |
| sssd-winbind-idmap | — | 2.9.4-5.el8_10.5 |
References
Similar Threats
- Unknown ALSA-2026:41937
- Unknown ALSA-2026:42122
- Unknown CLSA-2026-1777683406
- Unknown CLSA-2026-1777482027
- Unknown CLSA-2025-1766075810
More ALSA 2026 advisories
Browse all of ALSA 2026 in the advisory index.
Free Vulnerability Check
Is your site affected by ALSA-2026:46990?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against ALSA-2026:46990 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.