Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104046

Fedoraproject Sssd: denial of service

Risk score
43/100
CVSS
6.2 v3.1
Exploit chance (30 days)
0.1%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory cons…
Affected
Fedoraproject Sssd
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Public proof of concept

Story map

Story map: Fedoraproject SssdTHE FLAWSTHE FIXCVE-2026-104046Denial of serviceCVSS 6.2 · EPSS 0%CVE-2026-104048A flaw was found in SSSDCVSS 8.1 · EPSS 0%CVE-2026-104040Denial of serviceCVSS 6.1 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFedoraproject SssdYELLOW · PLAN IT INFedoraprojectSssdA flaw was found in SSSD. Intrust-enabled identitymanagement environments,SSSD evaluates Host-BasedAccess Control (HBAC) rules bystripping domain qualifiers andcomparing only short…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-770)202 other warnings in 30 days →Same productEarlier Fedoraproject Sssd warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Fedoraproject Sssd: Yellow, plan it in. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access p…

The flaws

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Fedoraproject Sssd

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.2 medium
  • Public exploit or proof of concept referenced

References

Original description

A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.

Last activity 6 Oct 2026. Patch Forecast updates every hour.