SSSD Multiple Security Flaws

Access control bypass in SSSD when configured with non-default ordering that evaluates password-expiration warnings before restrictive access rules allows remote authenticated users with expired passwords to gain unauthorized access to protected systems via alternative authentication methods such as SSH public key authentication. This flaw (CWE-393) affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 deployments using LDAP access control. Exploitation requires a specific non-default configuration, an expired password, and a non-password authentication path, making it a moderate conditional risk; no public exploit identified at time of analysis.

Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.

SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.

Denial of service in SSSD (the System Security Services Daemon) allows remote unauthenticated attackers to crash the daemon by presenting a certificate that is missing the expected Security Identifier (SID) extension during authentication or lookup operations. Only deployments explicitly configured with SID-based certificate mapping rules reach the vulnerable code path, since the certificate-to-user lookup logic dereferences the SID extension without first confirming it exists; standard installations that do not use SID-based certificate mapping are not affected. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, availability-only) and, per available intelligence, no public exploit code exists and exploitation has not been confirmed as active - no public exploit identified at time of analysis.

SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Memory exhaustion in the SSSD autofs responder can let a local, authenticated unprivileged user deny service on affected hosts by holding an open client connection while repeatedly submitting valid requests, since per-request memory is only reclaimed when the connection closes. The flaw affects SSSD deployments on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, but the vulnerable code path is only reachable when the autofs responder is explicitly enabled in sssd.conf - a non-default configuration. Exploitation is limited to local access (AV:L/PR:L) with no impact on confidentiality or integrity, so it is correctly rated medium (CVSS 5.5); no CISA KEV entry and no public exploit code have been identified at time of analysis, and a realistic impact generally requires a shared, multi-user host where one user's resource consumption degrades service for others.

A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.

A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.

Local denial of service in the SSSD Kerberos Credential Manager (KCM) responder allows an authenticated local user to exhaust host memory and make the service unresponsive by holding a persistent connection open while repeatedly storing and destroying Kerberos credentials. The flaw is a resource-lifecycle defect (CWE-772): cached objects are not released when credentials are removed, so memory grows monotonically until the responder stalls. Exploitation requires a valid local account and sustained store-then-destroy activity, yields availability impact only (CVSS 5.5, AV:L/PR:L/UI:N/A:H), and does not provide code execution or privilege escalation; no public exploit code or confirmed active exploitation was identified at time of analysis, and systems that do not use the KCM responder are not affected.

Unprivileged local users can exhaust memory in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries, causing denial of service on Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The negative cache in SSSD lacks a bound on total stored entries and only evicts expired records when an existing key is rechecked, so the cache grows until the responder becomes unresponsive or terminates. This is a local, availability-only issue requiring an authenticated account (CVSS 5.5, PR:L); no public exploit code or active exploitation is identified at time of analysis.

Denial of service in SSSD's autofs responder allows an authenticated local unprivileged user to repeatedly request master automount map updates, triggering global cache invalidation and forcing repeated backend directory lookups, which degrades automount availability and elevates resource consumption. Affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when SSSD-backed automount maps are served from a backend directory provider such as LDAP or Active Directory. This is a moderate-priority local availability issue (CVSS 5.5) with no public exploit code identified at time of analysis.

Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.

Authentication bypass in SSSD permits a user with valid credentials for an already-expired account to authenticate to the system when SSSD is configured to enforce account expiration using LDAP shadow attributes and the expiration value is stored as zero. This moderate-severity logic flaw (CVSS 5.4, CWE-193) affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4; exploitation requires the non-default shadowExpire=0 configuration and valid credentials for the expired account. No public exploit code or active exploitation has been identified at time of analysis.

Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).

The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.