Sssd: sssd: information disclosure via odata injection in entra id lookups
Historical advisory recorded 5 Nov 2026 16:36:21 UTC. Read the latest advisory.
cve-program · CVE-2026-104040
PublishedA flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-104040
PublishedSssd: sssd: information disclosure via odata injection in entra id lookups
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
- Source published
- 6 Oct 2026 01:00:44 UTC
- Source modified
- 5 Nov 2026 15:52:54 UTC
- Saved here
- 5 Nov 2026 16:36:21 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L