OS Command Injection Vulnerability in YaST2 Authentication Client by SUSE

CVE-2026-59681

What is CVE-2026-59681?

The YaST2 Authentication Client from SUSE is susceptible to an OS command injection flaw that allows an attacker to manipulate Active Directory configuration values to execute arbitrary commands with root privileges on the targeted host. The affected component, Auth::AuthConf, does not adequately validate or sanitize inputs for Organizational Unit (ou), dnshostname, AD username, and AD domain name. This oversight permits attackers to interpolate malicious commands into legitimate system calls, potentially leading to unauthorized access and control over the system.

References