CVE-2026-104040 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The System Security Services Daemon serves as a critical component in Linux environments for managing identity providers and authentication mechanisms, particularly when integrating with cloud-based directories such as Microsoft Entra ID. A significant security vulnerability has been identified within the SSSD implementation regarding its interaction with the Microsoft Graph Open Data Protocol queries used to retrieve user and group information from Entra ID. The core technical flaw lies in the insufficient input validation and sanitization of lookup names provided by local users before these inputs are embedded into OData filter expressions sent to the remote identity provider. Specifically, single quote characters within search strings are not properly escaped or neutralized prior to query construction. This oversight allows a malicious actor with low-privileged local access on the affected system to manipulate the structure of the outgoing API requests by injecting additional logical operators and conditions through crafted input payloads containing unescaped quotes.
This lack of proper escaping enables an attacker to alter the intended logic of the search queries, effectively performing what is known as query injection or filter manipulation. By carefully constructing a username or group name that includes single quote characters followed by specific OData syntax elements, a low-privileged local user can broaden the scope of the search beyond their authorized permissions. For instance, an attacker might close the initial string delimiter and append additional filters using logical OR operators to include wildcard searches for all users or groups within the directory. This capability transforms what should be a simple lookup operation into a mechanism for enumerating sensitive identity data that would otherwise remain inaccessible due to standard access control restrictions enforced by Entra ID.
The operational impact of this vulnerability is twofold, encompassing both information disclosure and potential denial of service conditions. In terms of confidentiality, the ability to broaden search filters allows attackers to retrieve unintended directory objects, potentially exposing usernames, email addresses, group memberships, and other metadata associated with users in the organization's Entra ID tenant. This data can be leveraged for further reconnaissance attacks against the broader infrastructure. Regarding availability, the vulnerability can trigger a Denial of Service scenario by forcing SSSD or the remote Microsoft Graph service to process excessively complex or broad queries. The resulting surge in processing load and cache population with large result sets can degrade system performance, consume excessive memory resources, or cause timeouts that disrupt legitimate authentication services for other users on the host machine.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command known as OS Command Injection when viewed broadly through the lens of input handling failures, though more specifically it maps to CWE-94 Improper Control of Generation of Code or Script such as SQL injection due to its nature of manipulating query structures. In terms of adversary tactics, this flaw facilitates initial access and discovery phases within the MITRE ATT&CK framework, particularly under techniques related to Credential Access via Unsecured Credentials if sensitive data is exfiltrated, or Discovery through System Information Discovery where attackers enumerate user accounts and group memberships to map out the identity landscape for subsequent lateral movement.
Mitigation strategies should focus on immediate patching of the SSSD package to a version that includes proper input sanitization logic for OData query construction. Administrators must ensure that all single quotes within lookup names are either escaped using standard SQL-like escaping mechanisms or replaced with safe alternatives before being passed to the Microsoft Graph API layer. Additionally, implementing strict input validation at the application level to reject or sanitize special characters in search fields can provide defense-in-depth against such injection attempts. Monitoring logs for unusual patterns of SSSD activity, particularly requests involving complex OData filters generated by low-privileged accounts, can aid in early detection of exploitation attempts while patches are being deployed across the environment.