CVE-2026-104038 Sssd: sssd: denial of service via missing sid extension in certificate mapping
Remote attackers can crash the SSSD service by submitting certificates missing SID extensions in specific configurations, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104038?
CVE-2026-104038 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations.
Weakness: CWE-476
Which versions are affected by CVE-2026-104038?
How do I fix CVE-2026-104038?
Apply the vendor's patch.
Is CVE-2026-104038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104038 exists.
Sources
Also known as DEBIAN-CVE-2026-104038, GHSA-qr5w-232p-j88j, UBUNTU-CVE-2026-104038.