Cloudanix VulnDB

CVE-2026-104040

Medium · 4.4

CVSS

4.4

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem handling certain characters in user searches on some Linux systems can let ordinary local users see extra directory details or slow the system down.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper escaping of single quotes in lookup names allows injection into Microsoft Graph OData queries, enabling modification of filter conditions to expand result sets and trigger excessive directory processing plus cache population.

Why it matters to the business

Low-privileged local users on affected Linux systems can obtain broader directory information than authorized or induce denial-of-service conditions through resource exhaustion, increasing operational risk in Entra ID-integrated enterprise environments where the packages are widely deployed.

How an attack unfolds

A local attacker supplies a lookup name containing a single quote in a search request processed by SSSD when configured for the Entra ID provider; the unescaped character alters the generated OData filter, causing the directory service to return additional objects or perform heavy query and caching work.

How to fix it

Apply vendor updates for fedoraproject sssd, redhat openshift container platform, and redhat enterprise linux as soon as fixed packages become available; until then, restrict use of the Entra ID provider or limit local user search capabilities where feasible.

How to confirm the fix worked

Test search functionality with single-quote payloads after patching to confirm queries remain properly escaped; review package versions and configuration to verify Entra ID is either disabled or running corrected code.

Typical attack path

  1. Obtain local low-privileged access on a system running the vulnerable SSSD package with Entra ID configured
  2. Craft and submit a search request containing a single quote in the lookup name
  3. Trigger query construction that injects the quote into the OData filter expression
  4. Receive expanded directory results or cause excessive processing and cache growth

How to detect it

Inspect SSSD and system logs for search operations containing unescaped single quotes or unusually broad OData filter results; correlate with Entra ID provider activity and monitor for spikes in directory query volume or cache usage.

What your security team should do

  • Prioritize deployment of forthcoming patches for all listed affected products
  • Temporarily disable Entra ID integration or restrict local search permissions until fixed
  • Monitor vendor advisories for exact fixed versions and schedule rapid rollout

The record

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities