A flaw was found in SSSD (System Security Services Daemon). (CVE-2026-104046)

CVE-2026-104046 describes a vulnerability in SSSD where, with IdP authentication enabled, pre-authentication requests maintain state in memory indefinitely without being cleared or timed out. This flaw permits a local attacker to repeatedly start authentication flows without completion, causing unbounded memory growth. The resulting memory exhaustion can degrade or terminate SSSD authentication services, leading to a denial of service condition. The vulnerability has a CVSS 3.1 base score of 6.2 (medium severity), with attack vector local, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability enables a local attacker to cause unbounded memory consumption in SSSD by repeatedly initiating but not completing authentication flows when IdP authentication is enabled. This memory exhaustion can degrade or terminate authentication services provided by SSSD, resulting in a denial of service condition that affects system authentication availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting local user access to systems running vulnerable SSSD versions or disabling IdP authentication if feasible to reduce exposure to this memory exhaustion issue.