CVE-2026-46689: Kanidm Identity Platform DoS Vulnerability

CVE-2026-46689 Overview

CVE-2026-46689 is a denial-of-service vulnerability in Kanidm, an open-source identity management platform. Versions prior to 1.9.3 contain a recursive-descent PEG parser that crashes the kanidmd process when fed deeply nested input. An unauthenticated attacker sends a single HTTP GET request to any /scim/v1/... endpoint with a ?filter= query string containing thousands of nested parentheses. The parser exhausts the worker thread's stack guard page, triggering std::process::abort() in Rust and terminating the daemon. The parse executes inside the axum Query<ScimEntryGetQuery> extractor before any handler logic, bypassing all access control checks.

Critical Impact
A single unauthenticated 4–12 KB HTTP request crashes the Kanidm identity daemon, disrupting authentication services for all dependent applications.

Affected Products

Kanidm identity management platform versions prior to 1.9.3
kanidmd server component exposing SCIM v1 endpoints
Deployments using axum-based HTTP routing with ScimEntryGetQuery extractor

Discovery Timeline

2026-06-10 - CVE-2026-46689 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46689

Vulnerability Analysis

The vulnerability is an uncaught exception leading to denial of service, classified under [CWE-248]. Kanidm's SCIM v1 endpoints accept a filter query parameter parsed by a recursive-descent Parsing Expression Grammar (PEG) parser. Each nested parenthesis in the filter expression consumes additional stack frames during recursive parsing. An input of roughly 4–12 KB containing thousands of nested parentheses depletes the worker thread's stack. Rust handles stack overflow by invoking std::process::abort(), which terminates the entire kanidmd process rather than the offending request.

Root Cause

The root cause is unbounded recursion in the SCIM filter parser combined with Rust's abort-on-stack-overflow behavior. The parser does not impose a maximum nesting depth on incoming filter expressions. Because the parse executes inside the axum Query<ScimEntryGetQuery> extractor, it runs before route handlers and before any authentication or ACL check. Any network attacker capable of reaching the SCIM endpoint can trigger the abort without credentials.

Attack Vector

Exploitation requires only network reachability to a Kanidm SCIM endpoint. The attacker issues a single HTTP GET request to any path under /scim/v1/ with a filter query string containing several thousand opening parentheses. The request body is small (a few kilobytes) and requires no authentication. The recursive parser consumes the worker thread's stack, crosses the guard page, and Rust aborts the process. Repeated requests after restart sustain the denial-of-service condition.

No verified exploit code is publicly indexed for CVE-2026-46689. Refer to the GitHub Security Advisory GHSA-r5fr-9gmv-jggh for additional technical detail.

Detection Methods for CVE-2026-46689

Indicators of Compromise

HTTP GET requests to /scim/v1/* endpoints containing query strings of 4 KB or larger with repeated ( characters.
Unexpected kanidmd process terminations with no clean shutdown log entry, followed by service supervisor restarts.
Spikes in 5xx responses or connection resets from the Kanidm server immediately after a single suspicious request.

Detection Strategies

Inspect reverse proxy and web application firewall logs for SCIM filter parameters exceeding a reasonable length threshold or containing high parenthesis density.
Monitor systemd or container orchestration logs for kanidmd exit code SIGABRT (signal 6) events.
Correlate authentication outages across dependent applications with inbound requests to SCIM endpoints.

Monitoring Recommendations

Enable access logging on the load balancer in front of Kanidm and alert on filter= parameters longer than 1 KB.
Track process restart frequency for kanidmd and alert on more than one restart per hour.
Forward Kanidm and reverse proxy logs to a centralized analytics platform for correlation with identity service availability metrics.

How to Mitigate CVE-2026-46689

Immediate Actions Required

Upgrade Kanidm to version 1.9.3 or later, which contains the upstream fix.
Restrict network exposure of /scim/v1/ endpoints to trusted client networks until patching is complete.
Deploy a reverse proxy rule that rejects requests with filter query parameters above a conservative byte limit.

Patch Information

The issue is patched in Kanidm version 1.9.3. Release artifacts and changelog details are published at the Kanidm GitHub Release v1.9.3. Administrators should pull the updated container image or rebuild from the tagged source and restart kanidmd.

Workarounds

Place Kanidm behind a reverse proxy such as nginx or HAProxy and enforce a maximum query string length of a few hundred bytes for SCIM routes.
Block unauthenticated external access to /scim/v1/ paths at the network edge using firewall or WAF rules.
Use a process supervisor configured for rapid restart with rate limiting to reduce outage duration if exploitation occurs before patching.

bash

# Example nginx configuration to limit SCIM filter query length
location /scim/v1/ {
    if ($query_string ~* "filter=.{1024,}") {
        return 400;
    }
    proxy_pass http://kanidmd_upstream;
}