CVE-2026-104047: Improper Neutralization of Delimiters in Red Hat Red Hat Enterprise Linux 10

This vulnerability in SSSD occurs because search inputs are not properly neutralized before being incorporated into directory query filters when using Microsoft Entra ID. A local attacker with the ability to submit lookup requests can exploit this flaw to manipulate query logic, resulting in unauthorized disclosure of directory information. The CVSS 3.1 base score is 5.3, reflecting local attack vector with low complexity and no user interaction, causing limited confidentiality, integrity, and availability impacts.

The impact is unauthorized information disclosure from the directory due to manipulated query filters. The attacker must have local access and can cause limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of remote exploitation or privilege escalation beyond local user capabilities.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104047 for current remediation guidance. Until an official fix is available, restrict local user access and monitor for unusual lookup requests if possible.