Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable service login (AV:N) by an authenticated trusted-domain user (PR:L); bypass grants unauthorized read/modify access (C:H/I:H) but no availability loss (A:N).
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
AnalysisAI
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services that Host-Based Access Control (HBAC) rules are supposed to protect. Because SSSD strips the domain qualifier and compares only short usernames during HBAC evaluation, a trusted-domain user whose short name collides with an authorized local account is silently granted that local account's access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a trust-enabled identity-management environment (FreeIPA/IdM with a configured domain trust, e.g., to Active Directory) where HBAC rules govern access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, moderately-high-priority access-control flaw but not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was confirmed in the available data at time of analysis, so the authoritative fix guidance and the exact patched sssd package version must be taken from the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-104048) and Bugzilla 2478613 (https://bugzilla.redhat.com/show_bug.cgi?id=2478613); apply the updated sssd packages for RHEL 7/8/9/10 and the OpenShift Container Platform 4.x images as soon as errata are published, then restart sssd on each affected host. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis for CVE-2026-104048 in SSSD; monitor vendor advisories for FreeIPA/IdM and SSSD for an update. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Enterprise Linux
View allIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti
Same weakness CWE-1025 – Comparison Using Wrong Factors
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-93942
GHSA-474r-m56w-5qgh