CVE-2026-104048
published 2026-10-06CVE-2026-104048: A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain…
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.28%
19.0th percentile
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
vendor_redhat·2026-10-06·CVSS 6.8
CVE-2026-104048 [MEDIUM] CWE-1025 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
Statement: This vulnerability is rated as Moderate impact because exploitation requires a non-default trust deployment and an account collision between the local and trusted domains. An authenticated user within a trusted domain can bypass Host-Based Access Control (HBAC) restrictions if their username matches a local Id
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-10-06
CVE-2026-104048 [MEDIUM] CWE-1025 A flaw was found in SSSD.
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation [fedora-all]
bugzilla·2026-10-06·CVSS 6.8
CVE-2026-104048 [MEDIUM] CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation [fedora-all]
CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Potential HBAC Authorization Bypass via Cross-Domain Shortname
Collision: in trust-enabled IPA HBAC deployments, a trusted-domain user
whose shortname collides with an IPA-local user may satisfy user-specific
HBAC allow rules because both the request identity and the rule identity
are normalized to shortname-only values before comparison.
Requirements to exploit: IPA HBAC must be in use through SSSD,
t
Bugzilla
CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
bugzilla·2026-05-18·CVSS 6.8
CVE-2026-104048 [MEDIUM] CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
CVE-2026-104048 sssd: sssd: Authorization bypass via cross-domain username collision in HBAC evaluation
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Potential HBAC Authorization Bypass via Cross-Domain Shortname
Collision: in trust-enabled IPA HBAC deployments, a trusted-domain user
whose shortname collides with an IPA-local user may satisfy user-specific
HBAC allow rules because both the request identity and the rule identity
are normalized to shortname-only values before comparison.
Requirements to exploit: IPA HBAC must be in use through SSSD,
trusted-domain or subdomain users must be evaluated by the IPA HBAC path,
and an HBAC allow rule must reference an IPA-local user directly by name.
The attacker must be able to authenticate as a trusted-domain account whose
shortname colli
2026-10-06
Published