Cloudanix VulnDB

CVE-2026-104048

Medium · 6.8

CVSS

6.8

EPSS

0.3%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in identity software lets people from connected networks get into systems they should not reach simply by using the same everyday username as someone who is already allowed.

Exploit Available
Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

SSSD incorrectly evaluates HBAC rules by stripping domain qualifiers and comparing only short usernames, permitting cross-domain username collisions to grant unauthorized access in trust-enabled environments.

Why it matters to the business

Users from trusted domains can reach protected hosts or services without authorization, enabling unauthorized access and lateral movement in enterprise Red Hat and Fedora deployments where exploit code is already available.

How an attack unfolds

An attacker in a trusted domain registers or compromises an account whose short username matches an authorized local account; when the trusted user requests access, SSSD removes the domain portion, matches the bare name against HBAC rules written for the local account, and grants entry.

How to fix it

Apply vendor-supplied SSSD updates for Fedora, Red Hat Enterprise Linux, and OpenShift Container Platform as soon as they are released; until fixed packages are available, enforce globally unique short usernames across all trusted domains or restrict trust relationships where operationally feasible.

How to confirm the fix worked

After applying updates, verify that HBAC rules correctly distinguish full domain-qualified names; test access attempts using colliding short usernames from trusted domains and confirm denials are enforced; compare installed package versions against published advisories.

Typical attack path

  1. Map target hosts using SSSD with cross-domain trusts and HBAC rules
  2. Create or take over a trusted-domain account sharing a short username with an authorized local account
  3. Initiate authentication or service access from the trusted account
  4. Bypass occurs because SSSD strips the domain qualifier before rule evaluation

How to detect it

Inspect SSSD authentication and access logs for successful grants where domain qualifiers were stripped and short usernames matched local accounts; correlate with trusted-domain login sources and look for patterns of unexpected cross-domain access.

What your security team should do

  • Track Red Hat and Fedora advisories for SSSD fixes in RHEL, Fedora, and OpenShift
  • Audit existing HBAC rules for reliance on short usernames only
  • Enforce unique short usernames across all trusted domains
  • Increase logging verbosity on SSSD authentication decisions and review for anomalous grants

The record

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities