Description
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.
Published: 2026-10-06
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

An issue in the SSSD Kerberos Credential Manager (KCM) responder allows a local user to trigger a denial of service by keeping a persistent connection and repeatedly adding and removing credentials. The responder does not free cached objects when credentials are deleted, so memory consumption keeps growing until the system runs out of memory, causing the SSSD service to become unresponsive. The weakness is classified as CWE‑772 and results in a local denial of service.

Affected Systems

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 and Red Hat OpenShift Container Platform 4 are affected. No specific patch versions are given, so any release of these products may be vulnerable until a fix is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack requires local user privileges and does not provide remote access. An attacker would need to maintain an active KCM connection and continually churn credentials to force memory exhaustion, which would ultimately disrupt services that depend on SSSD.

Generated by OpenCVE AI on October 6, 2026 at 01:51 UTC.

Remediation

Vendor Workaround

This issue can only be exploited when the SSSD KCM responder is enabled and reachable by a local user, so mitigation focuses on limiting that exposure. On systems that do not require KCM credential caching, disable the KCM responder by stopping and masking the sssd-kcm socket and service: # systemctl stop sssd-kcm.socket sssd-kcm.service # systemctl mask sssd-kcm.socket sssd-kcm.service Before disabling KCM, ensure an alternative Kerberos credential cache type (for example FILE: or KEYRING:) is configured in /etc/krb5.conf, because clients or system configurations that default to KCM: credential caches would otherwise lose Kerberos ticket management. On systems where KCM is required, restrict access to the KCM UNIX socket (/var/run/.heim_org.h5l.kcm-socket) to trusted local users where deployment policy permits. If abnormal memory growth is observed, closing the abusive client connection or restarting the sssd-kcm responder reclaims the retained connection-scoped memory; these are operational workarounds rather than a fix, and no released package fix is currently established.

OpenCVE Recommended Actions

  • Update SSSD to a version that includes the memory‑release patch from Red Hat advisories.
  • Limit the privileges of local users who can interact with SSSD, or isolate them to reduce the ability to repeatedly store and delete credentials.
  • Monitor memory usage of the sssd process; if high usage or service unresponsiveness occurs, restart sssd or the host to recover functionality.

Generated by OpenCVE AI on October 6, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Sssd
Sssd sssd
Vendors & Products Redhat openshift Container Platform
Sssd
Sssd sssd

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.
Title Sssd: sssd: denial of service via memory exhaustion in kcm responder
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-772
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Openshift Openshift Container Platform
Sssd Sssd
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-16T10:57:33.917Z

Reserved: 2026-10-01T17:21:54.434Z

Link: CVE-2026-104035

cve-icon Vulnrichment

Updated: 2026-10-08T02:38:51.698Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-06T01:16:34.420

Modified: 2026-10-08T03:16:32.840

Link: CVE-2026-104035

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T23:47:43Z

Links: CVE-2026-104035 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:56:22Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime