CVE-2026-104047
published 2026-10-06CVE-2026-104047: A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query…
PriorityP426medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.10%
1.0th percentile
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-10-06
CVE-2026-104047 [MEDIUM] CWE-140 A flaw was found in SSSD.
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.
Red Hat
sssd: sssd: Information disclosure via query injection in Entra ID lookups
vendor_redhat·2026-10-06·CVSS 5.3
CVE-2026-104047 [MEDIUM] CWE-140 sssd: sssd: Information disclosure via query injection in Entra ID lookups
sssd: sssd: Information disclosure via query injection in Entra ID lookups
A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.
Statement: This vulnerability is rated as having Moderate impact because exploitation requires low-privileged local access and depends on an explicit, non-default configuration using the Entra ID identity provider. In typical Red Hat Enterprise Linux environments, this integration is not enabled by default. While an authenticated local user can manipulate generated query filte
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups [fedora-all]
bugzilla·2026-10-06·CVSS 5.3
CVE-2026-104047 [MEDIUM] CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups [fedora-all]
CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: OData Filter Injection in Entra ID Lookup (`oidc_child_id.c`)
Enables Overbroad Directory Queries: crafted lookup values containing
single quotes can escape intended OData string literals and broaden Entra
directory queries issued by the affected lookup path.
Requirements to exploit: A low-privileged local actor must be able to
trigger name-based lookups on a system that builds and uses the Entra ID
provider path (
Bugzilla
CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups
bugzilla·2026-05-18·CVSS 5.3
CVE-2026-104047 [MEDIUM] CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups
CVE-2026-104047 sssd: sssd: Information disclosure via query injection in Entra ID lookups
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: OData Filter Injection in Entra ID Lookup (`oidc_child_id.c`)
Enables Overbroad Directory Queries: crafted lookup values containing
single quotes can escape intended OData string literals and broaden Entra
directory queries issued by the affected lookup path.
Requirements to exploit: A low-privileged local actor must be able to
trigger name-based lookups on a system that builds and uses the Entra ID
provider path (`idp_type=entra_id`) with valid directory client credentials
and scopes. No separate user interaction is required.
Component affected: `sssd-2.12.0-1.el10`, `src/oidc_child/oidc_child_id.c`,
`entra_id_lookup()`.
Version affected: `sssd-2.
2026-10-06
Published