A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into… (CVE-2026-104047)

The vulnerability in SSSD arises from improper sanitization of search inputs when using Microsoft Entra ID integration. A local user can exploit this by crafting a lookup request that manipulates the query logic in directory filters, resulting in unauthorized disclosure of directory information. This issue affects numerous specific versions of SSSD as listed, and no known exploits are reported in the wild.

Exploitation of this vulnerability can lead to unauthorized disclosure of information from the directory service. The impact is limited to information disclosure and requires local user privileges. There is no indication of remote exploitation or privilege escalation beyond the local user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict local user access and avoid using vulnerable versions if possible.