EUVD-2026-93984
GHSA-35vq-gvvv-mccw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to host
-
DeliveryRepeatedly initiate IdP pre-auth requests
-
ExploitAbandon flows leaving uncleared state
-
ExecutionExhaust SSSD process memory
-
ImpactDegrade or terminate authentication service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that SSSD be configured with Identity Provider (IdP) authentication enabled - this is the specific feature whose pre-authentication flow retains uncleared, un-timed-out state in memory; systems not using IdP auth are not affected. The attacker must also have local access to the host to repeatedly initiate authentication flows (AV:L), though no credentials are needed since the state accumulates during pre-authentication (PR:N). Limiting factors: the IdP-auth configuration is not the default posture, impact is restricted to availability on the local host (no RCE, no data exposure), and remote exploitation is not possible. |
| Impact | This is a moderate-severity local Denial of Service with no public exploitation signals. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) is internally consistent with the description: a local attacker (AV:L) can trigger the flaw with low complexity (AC:L) and no credentials (PR:N), because the abuse happens during pre-authentication before any identity is established. Impact is confined to availability (A:H) with no confidentiality or integrity effect, matching the memory-exhaustion/DoS outcome. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or weaponization - this reads as a reliability/resource-management hardening issue rather than an urgent, internet-facing threat. The local-only attack vector materially lowers real-world risk versus the raw 6.2 score: an attacker already needs a local foothold and the deployment must have IdP authentication enabled (a non-default feature), so this is primarily relevant to multi-user or shared hosts using IdP-backed SSSD authentication. No signals conflict; the main limitation is missing exploitability telemetry (EPSS/POC status unknown from the input). |
| Exploit ScenarioDerived | On a system where SSSD is configured for IdP authentication, a local user repeatedly opens new pre-authentication flows and abandons them before completion. Because the pre-auth state is never cleared or timed out, memory grows without bound until SSSD degrades or is killed, denying authentication services to all users on the host. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
RemediationAI
The provided intelligence does not include a patched SSSD version, so confirm current fix status via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104046 and track the Red Hat Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2478662. Primary mitigation: if IdP authentication is not required, disable it in sssd.conf (remove or comment out the IdP/idp provider configuration) and restart SSSD, which removes the vulnerable pre-authentication code path entirely; the trade-off is that users lose external IdP login. If IdP authentication must remain enabled, reduce exposure by restricting local interactive access (the attack requires AV:L), confining SSSD with SELinux or AppArmor MAC policies, limiting which local accounts can connect to the SSSD socket, and imposing a systemd memory ceiling (for example MemoryMax= on the sssd service) or a monitored periodic restart as a stopgap; note that a memory ceiling will cause SSSD to be killed and authentication to be interrupted, and restarts disrupt active sessions. Monitor the sssd process for abnormal memory growth and alert on repeated unfinished pre-authentication flows.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SSSD is the system daemon that brokers authentication and identity lookups on Red Hat platforms, and its IdP authentication feature allows users to authenticate against external OAuth2/OIDC identity providers. During the pre-authentication phase, before any credentials or tokens are validated, SSSD allocates per-request state (such as session, nonce, or token objects) in memory. CWE-770 (Allocation of Resources Without Limits or Throttling) is the root cause: this state is never cleared and has no timeout, so an attacker who can start many pre-auth flows without finishing them can grow the daemon's memory footprint without bound. Per the assessed CVSS vector (AV:L/PR:N/UI:N), the attacker needs local access but no credentials, because the state accumulates during pre-authentication. Only SSSD instances configured with IdP authentication are vulnerable; default configurations do not enable that provider. The impact is limited to availability (C:N/I:N/A:H, S:U); no code execution or data disclosure is involved, and remote exploitation is not possible.
Know when Sssd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-authentication abuse needs no credentials (PR:N) but requires local flow initiation (AV:L); low complexity (AC:L) and availability-only impact (A:H, C/I:N) for a memory-exhaustion DoS.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cach
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whic
Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Servic
Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings befo
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a
Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS re
A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM res
A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's U
Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent e
Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the r
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uid
Exploit-DB