SSSD CVE-2026-104038

Exploitation requires the sssd deployment to be configured with SID-based certificate mapping rules - this is the specific, non-default feature that makes the vulnerable code path reachable; standard installations without SID-based cert mapping are not affected. The attacker must be able to present a certificate to an authentication or lookup operation and the certificate must lack the expected Security Identifier (SID) extension so that the unchecked dereference occurs. Limiting factors: the dependence on this particular mapping configuration (reflected in CVSS AC:H) significantly narrows the exposed population, and impact is confined to denial of service of the sssd process with no data disclosure or code execution.

This is a medium-severity (CVSS 5.9) availability-only flaw with a realistic but bounded risk profile. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) shows a network-reachable, unauthenticated vector but with high attack complexity and impact strictly limited to availability - no confidentiality or integrity loss (CWE-476, NULL pointer dereference). The AC:H rating correctly reflects that exploitation is not universal: it depends on a non-default deployment choice (SID-based certificate mapping rules). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was supplied in the input, so there is no signal of active or probable exploitation; absence of these is not proof of safety but means there is nothing to elevate this above its base score. Overall this reads as a genuine but non-urgent patching priority: a repeatable crash of an authentication/identity service (availability impact on a security-critical daemon can be meaningful for uptime and lockouts), not a high-impact remote-code-execution or data-exposure issue. Note the signals are internally consistent - network vector with high complexity matches a config-dependent, unauthenticated crash - so no contradictions require vendor verification here.

In an environment where sssd is configured with SID-based certificate mapping, a remote attacker submits a crafted certificate that omits the expected SID extension during a smartcard/certificate authentication or lookup operation. Because the service dereferences the missing extension without checking for its presence, the sssd process crashes, denying authentication services to legitimate users. No public exploit code was identified in the provided data, and the high attack complexity reflects the requirement for the specific mapping configuration to be present.