Every CVE Search/ Get API key

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names...

4.4 MediumRejected

Red Hat Product Security has been notified that this CVE is a duplicated of CVE-2026-104047

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.12%Unchanged since Oct 6, 2026
90%50%10%1%

What each source reports

GitHub Advisories Score usedGHSA-p2pv-jqxp-33qv 4.4

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names...

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

Record
GHSA-p2pv-jqxp-33qv
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-140
Updated
2026-11-02
CVE List No score

Red Hat Product Security has been notified that this CVE is a duplicated of CVE-2026-104047

Record
CVE-2026-104040
Updated
2026-11-06
EUVDEUVD-2026-92910 4.4

Red Hat Product Security has been notified that this CVE is a duplicated of CVE-2026-104047

Record
EUVD-2026-92910
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-06
NVD No score

Rejected reason: Red Hat Product Security has been notified that this CVE is a duplicated of CVE-2026-104047

Record
CVE-2026-104040
Updated
2026-11-06
OSV 4.4

Sssd: sssd: information disclosure via odata injection in entra id lookups

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

Record
CVE-2026-104040
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-140
Updated
2026-11-05
OSVDEBIAN-CVE-2026-104040 6.1

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

Record
DEBIAN-CVE-2026-104040
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-104040 4.4

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

Record
UBUNTU-CVE-2026-104040
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
sssd
Debian:12
 All versions, plus listed versions
2.10.1-12.10.1-22.11.1-12.11.1-22.11.1-2.1
Show 22 moreShow less
2.12.0-12.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-42.8.2-42.8.2-4+deb12u12.9.1-12.9.1-22.9.2-12.9.4-12.9.4-1.12.9.4-1.1~exp12.9.4-22.9.5-12.9.5-22.9.5-32.9.5-42.9.5-5
 None known
sssd
Debian:13
 All versions, plus listed versions
2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1
Show 7 moreShow less
2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4
 None known
sssd
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.12.5-21.13.1-21.13.2-11.13.3-11.13.4-1
Show 15 moreShow less
1.13.4-1ubuntu11.13.4-1ubuntu1.11.13.4-1ubuntu1.21.13.4-1ubuntu1.51.13.4-1ubuntu1.61.13.4-1ubuntu1.71.13.4-1ubuntu1.81.13.4-1ubuntu1.91.13.4-1ubuntu1.101.13.4-1ubuntu1.111.13.4-1ubuntu1.121.13.4-1ubuntu1.131.13.4-1ubuntu1.141.13.4-1ubuntu1.151.13.4-1ubuntu1.15+esm1
 None known
sssd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.15.3-2ubuntu11.15.3-3ubuntu11.16.0-5ubuntu11.16.0-5ubuntu21.16.1-1ubuntu1
Show 9 moreShow less
1.16.1-1ubuntu1.11.16.1-1ubuntu1.21.16.1-1ubuntu1.31.16.1-1ubuntu1.41.16.1-1ubuntu1.51.16.1-1ubuntu1.61.16.1-1ubuntu1.71.16.1-1ubuntu1.81.16.1-1ubuntu1.8+esm1
 None known
sssd
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.0-4ubuntu12.2.2-12.2.2-1ubuntu12.2.3-1.1ubuntu12.2.3-2
Show 14 moreShow less
2.2.3-32.2.3-3ubuntu0.12.2.3-3ubuntu0.22.2.3-3ubuntu0.32.2.3-3ubuntu0.42.2.3-3ubuntu0.62.2.3-3ubuntu0.72.2.3-3ubuntu0.82.2.3-3ubuntu0.92.2.3-3ubuntu0.102.2.3-3ubuntu0.112.2.3-3ubuntu0.122.2.3-3ubuntu0.132.2.3-3ubuntu0.13+esm1
 None known
sssd
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.4.1-2ubuntu42.5.2-4ubuntu12.5.2-4ubuntu32.5.2-4ubuntu42.6.1-1ubuntu3
Show 9 moreShow less
2.6.3-1ubuntu32.6.3-1ubuntu3.12.6.3-1ubuntu3.22.6.3-1ubuntu3.32.6.3-1ubuntu3.42.6.3-1ubuntu3.52.6.3-1ubuntu3.62.6.3-1ubuntu3.82.6.3-1ubuntu3.9
 None known
sssd
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.9.1-2ubuntu22.9.1-2ubuntu32.9.2-1ubuntu22.9.4-1ubuntu12.9.4-1.1ubuntu3
Show 10 moreShow less
2.9.4-1.1ubuntu52.9.4-1.1ubuntu62.9.4-1.1ubuntu6.12.9.4-1.1ubuntu6.22.9.4-1.1ubuntu6.32.9.4-1.1ubuntu6.42.9.4-1.1ubuntu6.52.9.4-1.1ubuntu6.62.9.4-1.1ubuntu6.72.9.4-1.1ubuntu6.8
 None known
sssd
Ubuntu:26.10
 All versions, plus listed versions
2.12.0-1ubuntu52.12.0-4ubuntu12.12.0-4ubuntu22.12.0-4ubuntu32.12.0-4ubuntu4
 None known
sssd
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.10.1-2ubuntu52.10.1-2ubuntu72.12.0-1ubuntu32.12.0-1ubuntu42.12.0-1ubuntu5
Show 5 moreShow less
2.12.0-1ubuntu5.12.12.0-1ubuntu5.22.12.0-1ubuntu5.32.12.0-1ubuntu5.42.12.0-1ubuntu5.5
 None known

History

History
RecordedChangedSources
products, references, severityNVD
referencesEUVD
description, products, references, severity, status, titleCVE List
affectedEUVD, NVD, OSV
factsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-104040 has been rejected by its source and should not be treated as a live vulnerability, published October 6, 2026. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open