CVE-2026-104047 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability resides within the System Security Services Daemon (SSSD), specifically affecting configurations that integrate with Microsoft Entra ID for identity management and authentication services. SSSD serves as a critical component in Linux and Unix environments, acting as an intermediary between local system security modules and remote directory services such as Active Directory or cloud-based identity providers like Azure AD. When configured to communicate with Microsoft Entra ID, the daemon processes various search queries initiated by local applications seeking user information, group memberships, or other directory attributes. The core technical flaw involves a failure in input validation logic within the query construction mechanism. Specifically, when SSSD receives lookup requests from local users or services running under those user contexts, it fails to adequately sanitize special characters and control sequences present in the search inputs before incorporating them into Lightweight Directory Access Protocol (LDAP) filter strings sent to the directory server. This lack of proper escaping allows for LDAP injection attacks, a class of vulnerabilities where malicious input alters the structure of database queries.
From an operational perspective, this vulnerability enables unauthorized information disclosure by local users who might otherwise have limited privileges on the host system. An attacker with access to any user account on the affected machine can craft specific lookup requests that exploit the unsanitized inputs. By injecting LDAP metacharacters such as asterisks or parentheses into search fields like usernames or email addresses, an adversary can manipulate the query logic executed by SSSD against Microsoft Entra ID. This manipulation allows the attacker to bypass intended filtering constraints and retrieve data that should remain restricted based on standard access control policies. For instance, a user might be able to enumerate other users' attributes, discover group memberships beyond their own scope, or potentially extract sensitive directory information that is not publicly available. The impact is particularly severe in environments where SSSD is used for centralized authentication across multiple systems, as compromising one endpoint could theoretically lead to broader reconnaissance of the identity infrastructure if the attacker can move laterally or gain higher privileges on other hosts using the same credentials obtained through this leakage.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-90, which describes Improper Neutralization of Special Elements used in an LDAP Query, commonly known as LDAP Injection. It also relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command, if the underlying implementation allows command-like injection through query parameters, though the primary vector here is directory service manipulation. In terms of the MITRE ATT&CK framework, this flaw facilitates reconnaissance activities, specifically mapping to T1069, Permission Groups Discovery, and potentially T1087, Account Discovery. An attacker leveraging this vulnerability would be performing information gathering to build a profile of valid accounts and their associated permissions within the Microsoft Entra ID tenant, which is often a precursor to more destructive actions such as privilege escalation or lateral movement across networked systems relying on SSSD for authentication.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is applying vendor-provided patches that update SSSD to versions where input sanitization has been rigorously implemented. Administrators should ensure that all endpoints utilizing SSSD with Microsoft Entra ID integration are updated promptly upon the release of security advisories from Red Hat or relevant distribution maintainers, as SSSD is commonly packaged within enterprise Linux distributions like RHEL, CentOS Stream, and Fedora. In addition to patching, organizations should enforce strict least-privilege principles for local user accounts on systems running vulnerable versions of SSSD. Limiting which users can initiate directory lookups or restricting access to specific authentication services can reduce the attack surface available to potential adversaries. Furthermore, implementing network-level controls such as firewalls that restrict direct LDAP traffic from endpoints to Microsoft Entra ID endpoints where possible, although cloud-based identity providers often require open internet connectivity for SSO scenarios, making endpoint hardening more critical. Monitoring logs for anomalous query patterns or unusual spikes in directory lookups can also aid in early detection of exploitation attempts before significant data exfiltration occurs.