EUVD-2026-93941
GHSA-g6q7-jchg-6v7f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as local user on SSSD host
-
ExploitSubmit crafted lookup with filter metacharacters
-
ExecutionInjected characters alter directory query filter
-
ImpactUnauthorized directory information disclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Delimiter neutralization
|
| Exploitation Conditions | Exploitation requires SSSD to be specifically configured to use Microsoft Entra ID as its identity/directory backend - this is a non-default, deployment-specific configuration. The attacker must already be a local user (AV:L) with low privileges (PR:L) capable of submitting lookup/search requests through SSSD. The limiting factors that reduce realistic risk are: no remote or network exploitation path, a pre-existing local account is required, and hosts using only traditional AD/LDAP/IPA backends (not Entra ID) are not affected. No end-user interaction is needed (UI:N). |
| Impact | This is a moderate-severity, low-urgency issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 5.3) requires LOCAL access and LOW privileges (PR:L), meaning an already-authenticated local user - not a remote, unauthenticated attacker. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation; this reads as a hygiene/defense-in-depth fix rather than an emergency. One notable inconsistency: the description characterizes the flaw strictly as 'unauthorized information disclosure' from the directory, yet the input vector asserts Integrity AND Availability impact (I:L/A:L). A pure directory-query-filter injection (CWE-140) typically yields confidentiality impact only, so the I:L/A:L claims are not supported by the description and should be verified against the Red Hat advisory. Combined with the local attack vector and the requirement that SSSD be specifically configured against Microsoft Entra ID, real-world risk is limited and should be prioritized below network-facing or KEV-listed vulnerabilities. |
| Exploit ScenarioDerived | A local user on a Linux host running SSSD configured against Microsoft Entra ID submits a lookup (e.g. user/group search) containing crafted filter metacharacters that are not sanitized before being embedded into the directory query. By manipulating the resulting filter logic, the user coerces the directory into returning entries or attributes they were not authorized to see. No public exploit code was identified at time of analysis, and the attack requires an existing local account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in SSSD deployments configured to use Microsoft Entra ID as their identity backend, where a local low-privileged user can submit a crafted lookup request that is incorporated unsanitized into a directory query filter, manipulating the query logic to return directory data outside the requester's intended scope. Only hosts explicitly configured with the Entra ID backend are affected; standard AD, LDAP, or IPA backend deployments are not. Exploitation requires a pre-existing local account with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and there is no remote path, so this is assessed as a moderate-severity, low-urgency issue with no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch was identified in the available intelligence for CVE-2026-104047; check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104047 and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2478616 for the patched SSSD package version and apply it as soon as it is published, since the fix is expected to add proper escaping of delimiter characters before search input is composed into the Entra ID query filter. Until then, the most effective compensating control is to remove the attack prerequisite: audit hosts running the Entra ID backend and eliminate unnecessary local interactive accounts and shell access, because exploitation requires an existing low-privileged local user and has no remote path - the trade-off is reduced operational convenience for legitimate local administration. Where the Entra ID backend is not operationally required, switching the affected hosts to an AD, LDAP, or IPA provider removes the vulnerable code path entirely, at the cost of reconfiguring identity integration. Additionally, constrain the scope of identity data reachable by the Entra ID service account in Microsoft Entra ID so that even a successful filter manipulation cannot reach sensitive or high-privilege directory objects, and enable and review SSSD debug logs on Entra ID-enabled hosts to detect anomalous or unexpectedly broad lookup patterns - noting that debug logging adds disk and CPU overhead and should be time-boxed. Do not rely on network segmentation or firewall rules as a mitigation here, since the exploitation vector is strictly local to the host.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SSSD (System Security Services Daemon) is the identity and authentication broker on Linux that abstracts directory backends such as LDAP, FreeIPA, Active Directory, and Microsoft Entra ID, letting local services resolve users, groups, and other directory objects through a common interface. This issue is classified as CWE-140 (Improper Neutralization of Delimiters) and manifests as a filter-injection defect: in the Entra ID backend code path, user-supplied search input is concatenated into the directory query filter without escaping the delimiter/special characters that give the filter its structure. Because the injected characters are interpreted as query syntax rather than literal search text, an attacker who can drive a lookup through SSSD can reshape the filter's logic - broadening or altering the search predicate - so that objects the requester was never entitled to see are matched and returned. The independent assessment confirms the impact is confined to confidentiality (C:L) with no integrity or availability effect, no scope change, and no user interaction, and notes that the vulnerable code is only reachable when SSSD is explicitly pointed at the Entra ID backend, a non-default configuration.
Know when Sssd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Local authenticated user (AV:L/PR:L) with no interaction; description states information disclosure only, so C:L and I:N/A:N - the input's I:L/A:L is unsupported.
Primary rating from Vendor (redhat).
CVSS VectorNVD
DescriptionNVD
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cach
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whic
Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Servic
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings befo
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker wh
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS re
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM res
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's U
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent e
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the r
Exploit-DB