CVE-2026-104048 in Red Hat
Summary
by MITRE • 10/06/2026
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified within System Security Services Daemon, commonly known as SSSD, represents a critical logic flaw in how identity management systems enforce Host-Based Access Control rules in trust-enabled environments. In complex enterprise architectures where multiple domains are linked through cross-domain trusts, the integrity of access control relies heavily on precise user identification and rule evaluation. The core technical deficiency lies in the parsing mechanism used by SSSD when evaluating HBAC policies. Instead of maintaining the full distinguished name or domain-qualified username which uniquely identifies a principal across different realms, the system strips away the domain qualifier during the comparison process. This normalization step reduces complex identity strings to simple short usernames, effectively treating users from distinct domains as identical if they share the same local alias.
This architectural oversight creates a significant security gap that allows for unauthorized access through credential collision. An authenticated user residing in a trusted external domain can exploit this behavior by selecting a username that matches an authorized account within the local or primary domain. When such a user attempts to authenticate against a protected service governed by HBAC rules, SSSD evaluates their request based solely on the short name portion of their identity. Since the system perceives the external user as equivalent to the locally authorized internal user due to the matching username string, it grants access permissions that were explicitly intended only for the local account. This bypasses the granular restrictions designed to limit service availability to specific groups or individuals within trusted boundaries.
The operational impact of this vulnerability is severe, particularly in organizations relying on SSSD for centralized authentication and authorization across heterogeneous environments such as Active Directory trusts with Linux endpoints. Attackers who possess valid credentials in a less-privileged or external domain can leverage shared usernames to escalate privileges or access sensitive resources that should remain inaccessible. This undermines the principle of least privilege and compromises the isolation between trusted domains. The flaw effectively neutralizes the security boundary established by HBAC policies, allowing lateral movement within the network infrastructure without requiring additional exploitation techniques beyond valid authentication in a linked domain.
From a classification perspective, this issue aligns with CWE-287 Improper Authentication, as the system fails to correctly distinguish between distinct entities during the authorization phase despite successful initial authentication. It also relates closely to CWE-693 Protection Mechanism Failure because the protective control (HBAC rule evaluation) does not function as intended due to a logic error in identity resolution. In terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK T1078 Valid Accounts and potentially T1528 Steal Application Access Token if combined with other exploitation vectors, allowing attackers to operate under the guise of legitimate users while bypassing access controls designed to restrict their scope.
Mitigation strategies must focus on ensuring that identity resolution remains strict and context-aware within trust relationships. Administrators should configure SSSD to prioritize domain-qualified names or fully qualified user identifiers when evaluating HBAC rules, thereby preventing the ambiguity caused by short name collisions. Additionally, implementing unique username policies across all trusted domains can eliminate the possibility of such conflicts occurring in the first place. Regular auditing of access logs for anomalous login patterns from unexpected domains using common usernames may also help detect potential exploitation attempts before significant damage occurs. Updating SSSD to versions that include patches addressing this logic flaw is essential, alongside reviewing and tightening HBAC rule definitions to ensure they account for domain context explicitly rather than relying on ambiguous short-name matching.