CVE-2026-59681
Received Received - Intake

OS Command Injection in yast2-auth-client

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: SUSE

Description
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-59681
EUVD
EUVD-2026-69001

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
suse yast2-auth-client *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in yast2-auth-client. It allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the affected host. The issue occurs because configuration values are directly interpolated into command strings without validation or shell-quoting, which are then passed to Ruby's Open3.popen2 or Open3.capture2 functions.

Detection Guidance

Check for unauthorized root-level command execution attempts or unusual Samba net ads join, lookup, or testjoin commands in system logs. Look for suspicious Active Directory configuration values being processed by yast2-auth-client.

Impact Analysis

An attacker could exploit this to gain full root access on the configured host, allowing them to install malware, steal data, modify system files, or disrupt services. Since the vulnerability involves Active Directory configuration, attackers with control over these values could pivot to other systems in the network.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection), HIPAA (health information), or other regulations that mandate strict access controls and data security measures.

Mitigation Strategies

Update yast2-auth-client to the latest patched version. Validate and sanitize all Active Directory configuration values before processing. Avoid using untrusted input in command interpolation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart