Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104048

A flaw was found in SSSD

Risk score
57/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access p…
Affected
Fedoraproject Sssd
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Public proof of concept

Story map

Story map: Fedoraproject SssdTHE FLAWSTHE FIXCVE-2026-104048A flaw was found in SSSDCVSS 8.1 · EPSS 0%CVE-2026-104046Denial of serviceCVSS 6.2 · EPSS 0%CVE-2026-104040Denial of serviceCVSS 6.1 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFedoraproject SssdYELLOW · PLAN IT INFedoraprojectSssdA flaw was found in SSSD. Intrust-enabled identitymanagement environments,SSSD evaluates Host-BasedAccess Control (HBAC) rules bystripping domain qualifiers andcomparing only short…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-1025 (CWE-1025)3 other warnings in 30 days →Same productEarlier Fedoraproject Sssd warnings3 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Fedoraproject Sssd: Yellow, plan it in. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access p…

The flaws

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Fedoraproject Sssd

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 8.1 high
  • Public exploit or proof of concept referenced

References

Original description

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

Last activity 6 Oct 2026. Patch Forecast updates every hour.