PT-2026-106294

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-104041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Becau...

Linux Distros Unpatched Vulnerability : CVE-2026-104038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A remote attacker can cause a denial of service DoS by submitting a certificate that lacks an expected Security Identifier SID...

Linux Distros Unpatched Vulnerability : CVE-2026-104030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token...

Linux Distros Unpatched Vulnerability : CVE-2026-104039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services...

PT-2026-107231

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

Linux Distros Unpatched Vulnerability : CVE-2026-104035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. An issue in the Kerberos Credential Manager KCM responder allows a local user to cause a Denial of Service DoS by maintaining a...

Linux Distros Unpatched Vulnerability : CVE-2026-104029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to...

CVE-2026-104048: Comparison Using Wrong Factors

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2026-104047: Improper Neutralization of Delimiters

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-104043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a...

PT-2026-107174

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

PT-2026-107173

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-104031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released...

Linux Distros Unpatched Vulnerability : CVE-2026-104040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being...

Linux Distros Unpatched Vulnerability : CVE-2026-104042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a...

CVE-2026-104046: Allocation of Resources Without Limits or Throttling

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

DEBIAN-CVE-2026-104029

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...

DEBIAN-CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-104029

A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs...