CVE-2026-104048
highA flaw was found in SSSD.
Vendor / product: Fedoraproject — sssd
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
CVSS
8.1
8.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-10-06 20:17
Modified: 2026-10-09 12:54
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fedoraproject / sssd 2.12.0
redhat / openshift_container_platform 4.0
redhat / enterprise_linux 7.0, 8.0, 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-104048
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2478613
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2478613
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=2478613
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=2478613
References
- https://access.redhat.com/security/cve/CVE-2026-104048 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2478613 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2478613 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗