SSSD CVE-2026-104040

Exploitation requires SSSD to be configured with the Microsoft Entra ID identity provider (id_provider), which is a non-default backend compared to the common LDAP/Active Directory/IPA providers - deployments using those are not affected. The attacker must already be an authenticated local user with low privileges (PR:L) capable of submitting a lookup/search request through SSSD's NSS/name-resolution interface, and must craft a lookup name containing single quotes that reach the Microsoft Graph OData filter unescaped. The flaw is not reachable remotely and not reachable without the Entra ID provider enabled, which substantially narrows the exposed population.

This is a genuinely low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, base 4.4 Medium) describes a local, low-privileged, low-complexity flaw with only partial confidentiality and availability impact and no integrity impact - consistent with the description of a low-privileged local user broadening OData query filters to retrieve unintended directory objects (info disclosure) and to overload processing/cache (DoS). No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The local attack vector and authentication requirement sharply cap real-world risk - this is not a remotely exploitable, pre-auth issue. A key limiting factor not captured by the raw score is that exploitation requires SSSD to be configured specifically with the Entra ID identity provider, which is a non-default, comparatively uncommon backend; verify provider configuration before prioritizing. Overall: a real but bounded defense-in-depth fix, not an emergency.

On a RHEL host where SSSD is configured to use the Microsoft Entra ID identity provider, a low-privileged local user issues a user/group lookup whose name embeds single quotes. Because the input is not escaped before being placed into the Microsoft Graph OData query filter, the attacker alters the filter logic to return directory objects they were not meant to see, or forces expensive broad queries that exhaust processing and bloat the SSSD cache (DoS). No public exploit code was identified at time of analysis.