Description
A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.
Published: 2026-10-06
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

SSSD (System Security Services Daemon) contains a flaw that allows incomplete identity provider authentication requests to keep state in memory forever. When an attacker locally initiates multiple authentication flows without completing them, the process consumes unbounded memory. This exhaustion can degrade or terminate SSSD authentication services, resulting in a denial of service.

Affected Systems

Red Hat Enterprise Linux 10, 6, 7, 8, 9 and Red Hat OpenShift Container Platform 4 are affected. The vulnerability is present in the SSSD component of these distributions.

Risk and Exploitability

The CVSS score of 6.2 indicates medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. However, the flaw is exploitable by a local attacker who can repeatedly trigger the authentication workflow, so it poses a reasonable risk in environments with local user access.

Generated by OpenCVE AI on October 6, 2026 at 23:17 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply any future vendor update or patch for SSSD as soon as it becomes available
  • If an update is not yet released, monitor SSSD for abnormal memory growth and restart the service to release memory
  • Consider temporarily disabling identity provider authentication until a fix is issued to reduce the attack surface

Generated by OpenCVE AI on October 6, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Fedoraproject
Fedoraproject sssd
CPEs cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Fedoraproject
Fedoraproject sssd

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Sssd
Sssd sssd
Vendors & Products Redhat openshift Container Platform
Sssd
Sssd sssd

Fri, 09 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.
Title Sssd: sssd: denial of service via incomplete identity provider authentication requests
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-770
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Fedoraproject Sssd
Redhat Enterprise Linux Openshift Openshift Container Platform
Sssd Sssd
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-09T01:45:14.521Z

Reserved: 2026-10-01T17:25:56.761Z

Link: CVE-2026-104046

cve-icon Vulnrichment

Updated: 2026-10-09T01:45:10.886Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T21:17:04.300

Modified: 2026-10-13T15:35:28.760

Link: CVE-2026-104046

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T15:44:37Z

Links: CVE-2026-104046 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:31:55Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling