CVE-2026-104040
published 2026-10-06CVE-2026-104040: A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before…
PriorityP427medium6.1CVSS 3.1
AVLACLPRLUINSUCLINAH
EPSS
0.10%
0.8th percentile
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux/OpenShift Container Platform sssd information disclosure
vuldb·2026-10-06
CVE-2026-104040 [LOW] Red Hat Enterprise Linux/OpenShift Container Platform sssd information disclosure
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been declared as problematic. Affected is an unknown function of the component sssd. The manipulation results in information disclosure.
This vulnerability is cataloged as CVE-2026-104040. The attack may be launched remotely. There is no exploit available.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-10-06
CVE-2026-104040 [MEDIUM] CWE-140 A flaw was found in SSSD.
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
Red Hat
sssd: sssd: Information disclosure via OData injection in Entra ID lookups
vendor_redhat·2026-10-06·CVSS 4.4
CVE-2026-104040 [MEDIUM] CWE-140 sssd: sssd: Information disclosure via OData injection in Entra ID lookups
sssd: sssd: Information disclosure via OData injection in Entra ID lookups
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
Statement: This vulnerability is rated as Moderate because exploitation requires local access and non-standard domain configuration using the Entra ID identity provider (`idp_typ
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups [fedora-all]
bugzilla·2026-10-06
CVE-2026-104040 [MEDIUM] CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups [fedora-all]
CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: OData Injection in Entra ID Lookup via Unescaped Name Input
(`entra_id_lookup`): crafted lookup names containing a single quote can
alter Microsoft Graph OData `$filter` semantics, broadening Entra user or
group queries and causing unintended directory objects to be fetched,
processed, and cached.
Requirements to exploit: A deployment of `sssd-2.12.0-1.el10` using the IdP
provider for Entra ID lookups, an IdP clien
Bugzilla
CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups
bugzilla·2026-05-18
CVE-2026-104040 [MEDIUM] CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups
CVE-2026-104040 sssd: sssd: Information disclosure via OData injection in Entra ID lookups
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: OData Injection in Entra ID Lookup via Unescaped Name Input
(`entra_id_lookup`): crafted lookup names containing a single quote can
alter Microsoft Graph OData `$filter` semantics, broadening Entra user or
group queries and causing unintended directory objects to be fetched,
processed, and cached.
Requirements to exploit: A deployment of `sssd-2.12.0-1.el10` using the IdP
provider for Entra ID lookups, an IdP client that can read user or group
data from Microsoft Graph, and a low-privileged actor who can trigger a
name-based lookup through SSSD with crafted input that reaches
`entra_id_lookup()`.
Component affected: `sssd-2.12.0-1.el10` IdP provide
2026-10-06
Published