Cloudanix VulnDB

CVE-2026-104047

Medium · 5.3

CVSS

5.3

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A person with access to certain Linux computers linked to Microsoft cloud identity services could make the system reveal more user or directory information than it should.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper sanitization of search inputs allows injection into directory query filters when SSSD is configured for Microsoft Entra ID, enabling a local user to manipulate query logic and cause unauthorized information disclosure.

Why it matters to the business

Local attackers can extract sensitive directory data from Entra ID, increasing risk of reconnaissance or further compromise on affected Fedora and Red Hat systems; with public exploit code available 28 days after disclosure, organizations should treat this as an immediate assessment priority.

How an attack unfolds

An attacker with local access on an affected system submits a crafted lookup request containing filter metacharacters to SSSD; the unsanitized input alters the Entra ID directory query, causing the service to return additional records beyond the intended scope.

How to fix it

Upgrade to vendor-supplied fixed versions of SSSD for Fedora and Red Hat Enterprise Linux / OpenShift once released; until then restrict local user privileges, limit Entra ID lookups to trusted processes, and monitor query activity.

How to confirm the fix worked

Compare installed SSSD package versions against future fixed releases; test lookup operations with known injection payloads to confirm input sanitization prevents filter manipulation.

Typical attack path

  1. Obtain local shell or process execution on a system running SSSD with Entra ID integration
  2. Issue a lookup command or API call with specially crafted search input
  3. Observe responses that contain unauthorized directory entries leaked by the manipulated filter
  4. Use disclosed data to map users, groups, or attributes for follow-on attacks

How to detect it

Examine SSSD debug and audit logs for malformed or unusually broad directory queries; correlate with local process activity that performs repeated or suspicious user/group lookups.

What your security team should do

  • Inventory all systems using SSSD with Microsoft Entra ID
  • Apply available patches immediately upon release
  • Enforce least-privilege local access and review SSSD configuration
  • Enable detailed logging of directory queries for anomaly detection

The record

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities