CVE-2026-104048: SSSD Authentication Bypass Vulnerability

CVE-2026-104048 Overview

CVE-2026-104048 is an access control flaw in the System Security Services Daemon (SSSD) affecting trust-enabled identity management environments. SSSD strips domain qualifiers from usernames when evaluating Host-Based Access Control (HBAC) rules, comparing only the short username. An authenticated user in a trusted domain who shares a username with an authorized local account can bypass HBAC policies and access protected services or hosts. The flaw is categorized under [CWE-1025] (Comparison Using Wrong Factors). It carries a CVSS score of 6.8 and an EPSS probability of 0.276%.

Critical Impact
Authenticated users from trusted domains can impersonate the access rights of same-named local accounts, bypassing HBAC authorization and reaching services or hosts they should not be able to use.

Affected Products

SSSD (System Security Services Daemon) in trust-enabled identity management deployments
Red Hat Identity Management (IdM) environments configured with cross-forest trusts
Linux hosts relying on SSSD HBAC for authorization decisions

Discovery Timeline

2026-10-06 - CVE-2026-104048 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104048

Vulnerability Analysis

SSSD enforces Host-Based Access Control rules to determine which users may authenticate to specific services on a host. In environments with cross-forest or cross-domain trusts, usernames are typically fully qualified with a domain suffix such as user@TRUSTED.EXAMPLE.COM. The vulnerable logic strips the domain qualifier before performing the comparison against the HBAC rule set.

This short-name comparison treats user@LOCAL.EXAMPLE.COM and user@TRUSTED.EXAMPLE.COM as equivalent identities. A user from a trusted domain who registers or already holds the same short username as a privileged local principal inherits that principal's HBAC entitlements. The result is an authorization decision based on the wrong identity attribute.

Successful exploitation yields unauthorized access to services or hosts protected by HBAC, with high confidentiality and integrity impact.

Root Cause

The root cause is comparison using the wrong factor [CWE-1025]. HBAC evaluation compares short usernames instead of fully qualified principal names, discarding the domain component that distinguishes identities across trust boundaries. The identity model treats the short name as unique, which is not a valid assumption in multi-domain deployments.

Attack Vector

An attacker requires an authenticated account in a trusted domain and must know or guess the short username of an authorized local account. The attacker authenticates to a target host using the trusted-domain credentials. SSSD strips the domain qualifier, matches the short name against an HBAC rule authorizing the local account, and grants access. No user interaction on the target host is required, though the attack complexity is high because it depends on username collisions and existing trust relationships.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-104048 Advisory and Red Hat Bug Report #2478613 for vendor technical details.

Detection Methods for CVE-2026-104048

Indicators of Compromise

Successful authentications to HBAC-protected services by users whose fully qualified principal belongs to a trusted domain, where the matching HBAC rule only names a local-domain account.
SSSD debug logs showing HBAC rule matches against short usernames while the authenticating principal carries a non-local domain suffix.
Access from trusted-domain accounts to hosts or services that have no explicit HBAC rule for that trusted domain.

Detection Strategies

Enable SSSD debug logging at level 7 or higher and correlate pam_sss authentication events with the fully qualified principal used for authentication.
Audit HBAC rule evaluation outcomes against the domain component of the source principal; flag mismatches between the authorizing rule's domain and the authenticating user's domain.
Compare ipa hbactest results for identically-named principals across the local and trusted domains to identify collisions.

Monitoring Recommendations

Monitor /var/log/sssd/ and /var/log/secure for authentication events from trusted-domain principals on hosts intended only for local-domain users.
Alert on first-seen trusted-domain principals successfully accessing HBAC-protected services such as SSH, sudo, or cockpit.
Track creation of accounts in trusted domains whose short names match privileged local accounts such as admin, root-equivalent, or service accounts.

How to Mitigate CVE-2026-104048

Immediate Actions Required

Inventory HBAC rules and identify any short-name references that could collide with usernames in trusted domains.
Audit trusted-domain user directories for accounts whose short names match authorized local accounts and disable or rename collisions.
Apply the SSSD updates referenced in the Red Hat CVE-2026-104048 Advisory as they become available for your distribution.

Patch Information

Consult the Red Hat CVE-2026-104048 Advisory and Red Hat Bug Report #2478613 for the authoritative list of fixed SSSD package versions for each supported Red Hat Enterprise Linux release. Apply vendor-supplied updates through your standard package management workflow and restart the sssd service after upgrade.

Workarounds

Define HBAC rules using fully qualified principal names rather than short usernames where supported, so trust-domain identities cannot match local-domain rules.
Enforce a naming policy that prevents short-name collisions between the local domain and trusted domains, particularly for privileged accounts.
Restrict which trusted domains are permitted to authenticate against sensitive hosts by using domain_resolution_order and explicit allow-lists in sssd.conf.
Where feasible, temporarily disable cross-forest trust logins to hosts enforcing HBAC until patched SSSD packages are deployed.

bash

# Example sssd.conf hardening: constrain domain resolution and disable short-name fallback
[sssd]
domains = local.example.com
[domain/local.example.com]
id_provider = ipa
ipa_server = ipa.local.example.com
full_name_format = %1$s@%2$s
use_fully_qualified_names = True
default_domain_suffix = local.example.com