A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
CVE-2026-104039 is a medium severity vulnerability in Red Hat Enterprise Linux 10's SSSD component. It involves an expired pointer dereference during GSSAPI authentication in the PAM responder, which can cause a denial of service by crashing system authentication services when a local user sends an additional request over the same connection.
CVE-2026-104038 is a medium severity vulnerability in sssd on Red Hat Enterprise Linux 10. It allows a remote attacker to cause a denial of service by submitting a certificate missing an expected Security Identifier (SID) extension. When SID-based certificate mapping rules are configured, the service does not verify the extension's presence before processing, leading to a NULL pointer dereference and process crash during authentication or lookup.
CVE-2026-104037 is a vulnerability in the System Security Services Daemon (SSSD) component of Red Hat Enterprise Linux 10. A local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket, triggering an integer underflow and causing an out-of-bounds memory read. This results in the responder process crashing and a denial of service (DoS) condition. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity).
CVE-2026-92821 is a vulnerability in SSSD on Red Hat Enterprise Linux 10 where password expiration warnings are evaluated before restrictive LDAP access rules. This causes an expired-password warning to terminate rule evaluation early and incorrectly treat the access request as successful. A remote authenticated user with an expired password can exploit this by using alternative authentication methods like SSH public key authentication to bypass access controls and gain unauthorized access.
CVE-2026-104036 is an out-of-bounds write vulnerability in the SSSD NFS idmap plugin on Red Hat Enterprise Linux 10. The flaw occurs when the plugin attempts to copy cached user or group names that exceed the destination buffer size without aborting the operation. A local attacker can exploit this by triggering identity lookups that resolve to oversized cached entries, causing an out-of-bounds write. This primarily results in a denial of service by crashing the identity mapping service and may also corrupt adjacent process memory.
CVE-2026-104035 is a vulnerability in the Kerberos Credential Manager (KCM) responder component of SSSD on Red Hat Enterprise Linux 10. A local user can cause a denial of service by repeatedly storing and destroying credentials, which leads to memory exhaustion due to failure to release cached objects. This results in the service becoming unresponsive.
CVE-2026-104034 is a use-after-free vulnerability in the Kerberos Credential Manager (KCM) responder component of SSSD on Red Hat Enterprise Linux 10. It occurs during Kerberos ticket-granting ticket (TGT) renewal when a deferred callback accesses memory that has already been freed. An authenticated local user with a renewable Kerberos ticket can exploit this to crash the KCM responder service, causing a denial of service (DoS). The vulnerability has a medium severity rating with a CVSS score of 4.7.
CVE-2026-104033 is a medium severity vulnerability in Red Hat Enterprise Linux 10's SSSD component. It involves an off-by-one error where SSSD does not treat an LDAP shadow attribute expiration value of zero as an expired account. This flaw allows users with valid credentials for accounts intended to be expired to bypass access controls and authenticate, enabling unauthorized access to persist beyond intended deactivation.
CVE-2026-104032 is a vulnerability in SSSD on Red Hat Enterprise Linux 10 where an unprivileged local user can repeatedly request master automount map updates without proper authorization checks. This causes global cache invalidation and forces repeated backend directory lookups, resulting in denial of service due to degraded automount availability and increased resource consumption.
CVE-2026-104031 is a medium severity vulnerability in Red Hat Enterprise Linux 10's SSSD component. When the autofs responder service is enabled, memory allocated during request processing is not released until the client connection closes. A local attacker can exploit this by keeping a connection open and sending repeated valid requests, causing memory exhaustion and denial of service.
CVE-2026-105447 is an authorization flaw in Red Hat Quay 3 where build trigger requests expose repository write tokens to users with global read-only administrative privileges. Authenticated users with read-only access can exploit this to retrieve delegate tokens via the build trigger API. This allows them to bypass read-only restrictions and push container images to private repositories, resulting in privilege escalation.
CVE-2026-71297 is a vulnerability in Red Hat Multicluster Engine for Kubernetes involving the maestro gRPC broker. It allows a remote attacker with a valid client certificate to bypass authentication. This bypass can lead to unauthorized subscription to other consumers' event streams and the ability to publish forged agent status, resulting in information disclosure and data integrity compromise.
CVE-2026-104029 is a vulnerability in the SSSD component of Red Hat Enterprise Linux 10 where a local attacker can cause an out-of-bounds memory read by sending a specially crafted request to the autofs responder UNIX socket. This leads to a crash of the autofs responder process, resulting in a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 3.3, indicating low severity. No affected versions or patch information are explicitly provided in the input data.
CVE-2026-104030 is a vulnerability in the sssd component of Red Hat Enterprise Linux 10 that allows a local user to cause a Denial of Service (DoS). The flaw occurs when a specially crafted passkey authentication token lacking null terminators is submitted, causing an out-of-bounds read and process crash. This disrupts authentication services but does not impact confidentiality or integrity.
CVE-2026-71299 is a vulnerability in Red Hat Multicluster Engine for Kubernetes where the Maestro REST API write endpoints lack proper authentication. This flaw allows remote attackers to perform unauthorized write operations such as creating, modifying, or deleting consumers and resource bundles. The vulnerability can lead to data integrity issues or denial of service. It has a CVSS 3.1 score of 6.5, indicating medium severity. No affected versions or patch information are explicitly provided in the available data.
CVE-2026-71298 is a SQL injection vulnerability in Red Hat Multicluster Engine for Kubernetes. It affects the `orderBy` query parameter in the REST API list endpoints. The flaw allows a remote attacker to perform read-only blind extraction of data without authentication. The vulnerability has a medium severity with a CVSS score of 6.4.
CVE-2026-105326 is an argument injection vulnerability in the CUPS scheduler used in Red Hat Hardened Images. When email notifications are configured, the CUPS service improperly passes recipient addresses to the sendmail program without sanitizing input that could be interpreted as command-line options. This flaw allows a remote attacker with access to the CUPS service to supply crafted recipient values that may influence sendmail behavior and potentially execute commands with the privileges of the CUPS service user. The vulnerability's exploitation depends on the mail transfer agent installed and network exposure of the CUPS service. A security update addressing this issue is available from Red Hat.
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
A vulnerability in the HyperShift operator allows an authenticated user with cluster and secret creation permissions to achieve arbitrary code execution in the control plane. This occurs because the operator copies user-provided Kubernetes configuration secrets into a privileged namespace without proper validation, enabling unauthorized executable plugins to be introduced.