SSSD: Authorization bypass via username collision in HBAC evaluation
Summary
SSSD evaluates Host-Based Access Control (HBAC) rules in trust-enabled Identity Management environments by comparing only short usernames without domain qualifiers. An authenticated user in a trusted domain who shares a username with an authorized local IdM account can bypass the access policy and reach protected services or hosts. Red Hat rates the issue at 6.8 (Medium) because exploitation requires a non-default trust setup and an account collision, while NVD rates it at 8.1 (High).
Affected
- Red Hat Enterprise Linux 6 to 10 (per CNA record; RHEL 6 status listed as unknown)
- Red Hat OpenShift Container Platform 4
- SSSD in IdM environments with trusts to other domains where HBAC allow rules name local or IdM users
Fixed in
Unknown. Upstream fix in SSSD PR #9508, with backports in PR #9537 and PR #9538. No released package version confirmed by a vendor advisory.
Workaround
Unknown. Red Hat states that no mitigation is available that meets its criteria.
Exploitation
- CISA SSVC data in the CVE record: Exploitation 'poc', Automatable 'no', Technical Impact 'total'
- No public exploit code or write-up found in research; not confirmed as known exploited
Our recommendation
- Inventory FreeIPA/IdM deployments that have trusts to Active Directory domains
- Review HBAC rules that name local or IdM users whose short names also exist in trusted domains, and restrict them to groups or fully qualified identities where possible; test in staging first
- Install the SSSD update from your distribution once a fixed package is published, and verify the version against the vendor advisory
- Monitor authentication logs for access by trusted-domain accounts to sensitive hosts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-104048 access.redhat.com
- Red Hat Bugzilla 2478613 bugzilla.redhat.com
- SSSD upstream PR #9508 github.com
- SSSD backport PR #9537 github.com
- SSSD backport PR #9538 github.com
- OSV record CVE-2026-104048 osv.dev
- OpenCVE CVE-2026-104048 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:43.
Original description (NVD)
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.