CVE-2026-104048

Published: Oct 6, 2026Modified: Oct 9, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

Affected (6)

Products: Fedoraproject: Sssd · Redhat: Enterprise Linux, Openshift Container Platform

1 product

2 products

Openshift Container Platform

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Sssd	Version 2.12.0
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Openshift Container Platform	Version 4.0

Related CWEs

CWE-1025

Comparison Using Wrong Factors

The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

References (3)

https://access.redhat.com/security/cve/CVE-2026-104048

Source: secalert@redhat.com

Vendor AdvisoryIssue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=2478613

Source: secalert@redhat.com

ExploitIssue TrackingMitigationVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2478613

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingMitigationVendor Advisory

Timeline

No history available yet.