CVSS 10 in Crawl4AI: one HTTP request, full container takeover

An attacker who has AD GPO management access can abuse a path traversal bug in SSSD's GPO provider to write arbitrary files as root on Linux hosts that pull GPO policies. The function that parses the GPO file path doesn't strip ".." sequences, so the attacker can escape the GPO cache directory. On default RHEL setups with SELinux enforcing, this can still be chained to inject Kerberos config and bypass authentication.

Affected estate

Linux sysadmins running SSSD with AD GPO integration, particularly RHEL, CentOS, and Fedora hosts joined to Active Directory

How to check

Run `rpm -q sssd` or `dpkg -l sssd` to check the installed version. Review /etc/sssd/sssd.conf for ad_gpo_access_control settings.

Included because

root-level file write; authentication bypass chain; common in enterprise AD-joined Linux environments

Action

Apply the latest sssd security update from your distro vendor and restart the sssd service.

Why it matters

An attacker with GPO management rights can write files as root and potentially bypass authentication on every enrolled host.

A broken authorization check in Coolify lets any authenticated user clone resources into other teams' projects. The clone action validates access on the source resource but blindly trusts the destination ID, so an attacker can reach into another tenant's environment and deploy or access their resources. This is a full cross-tenant isolation break.

Affected estate

Anyone self-hosting Coolify versions before 4.0.0-beta.464, especially multi-tenant deployments with multiple teams

How to check

Check the Coolify version in the web UI footer or settings page. Anything below 4.0.0-beta.464 is vulnerable.

Included because

authenticated; cross-tenant access; CVSS 9.9; self-hosted management tool with broad control

Action

Update Coolify to 4.0.0-beta.464+ and review clone history for any cross-team resource transfers that shouldn't exist.

Why it matters

Authenticated users can break tenant isolation and access or modify other teams' servers, apps, and databases. CVSS 9.9.

When SSSD's LDAP sudo provider doesn't have an explicit search base configured, it searches the entire directory tree for sudoRole objects. Any authenticated user who can write to any subtree in LDAP can drop in a sudoRole that grants root-level sudo on every SSSD-enrolled host. This turns a low-privilege LDAP write into full root across your fleet.

Affected estate

Linux sysadmins using SSSD with LDAP-based sudo rules, especially those who haven't explicitly set ldap_sudo_search_base in sssd.conf

How to check

Check `grep ldap_sudo_search_base /etc/sssd/sssd.conf`. If the option is missing or commented out, the host is vulnerable. Also check the sssd package version.

Included because

authenticated; privilege escalation to root; affects all enrolled hosts; common misconfiguration

Action

Update sssd to the patched version, add an explicit ldap_sudo_search_base to sssd.conf, and restart sssd. Audit LDAP for unexpected sudoRole objects.

Why it matters

An authenticated LDAP user with write access to any subtree can grant themselves root sudo on all enrolled hosts.

A heap buffer overflow in 389 Directory Server's SASL I/O layer lets any authenticated user crash the LDAP server by sending an oversized UNBIND packet after a SASL bind. The receive buffer is 512 bytes, but there's no bounds check, so up to 2 MB of attacker data overflows it. In FreeIPA and Red Hat IdM deployments, any domain user, enrolled host, or service account with a valid Kerberos ticket can trigger this remotely. The vulnerable code has been present since roughly 2013.

Affected estate

Anyone running 389 Directory Server (389-ds-base), FreeIPA, or Red Hat Identity Management, particularly versions 1.3.2 and later

How to check

Run `rpm -q 389-ds-base` or `dsctl <instance> version` to check the installed version. Any unpatched version from 1.3.2 onward is affected.

Included because

authenticated; network-exploitable; affects core identity infrastructure; denial of service with potential for worse; long-standing bug

Action

Update 389-ds-base to the patched version and restart the directory server instance. This is separate from the CVE-2025-14905 fix, so verify both patches are applied.

Why it matters

Any authenticated domain user can crash your central directory server with a single crafted packet, taking down authentication for the entire domain.