CVE-2026-104048

Undergoing Analysis Undergoing Analysis - In Progress

SSSD HBAC Bypass via Username Collision in Trusted Domains

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: redhat-SADP

Description

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104048

EUVD

EUVD-2026-93942

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
fedoraproject	sssd	2.12.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1025	The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

Executive Summary

This vulnerability in SSSD allows an authenticated user in a trusted domain to bypass access controls by exploiting how HBAC rules are evaluated. The system compares only short usernames after stripping domain qualifiers, so a user with the same username as a local authorized account can gain unauthorized access to protected services or hosts.

Detection Guidance

To detect this vulnerability, check SSSD logs for HBAC rule evaluations involving trusted domains. Look for cases where short usernames are compared without domain qualifiers. Verify if local and trusted domain users share identical usernames and if access was granted despite domain differences.

Impact Analysis

If exploited, this flaw could let attackers with valid credentials in a trusted domain access systems they shouldn't, potentially leading to data breaches, unauthorized privilege escalation, or service disruption. The impact depends on the environment and access policies in place.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements in GDPR or HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to failed access control audits.

Mitigation Strategies

Review and update HBAC rules to ensure domain-qualified usernames are used for access control. Disable trust-enabled environments if not required. Monitor logs for unauthorized access attempts by users with shared usernames.

Hi! I’m here to help you understand CVE-2026-104048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70