Is CVE-2026-104048 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104048 being exploited in the wild.

How severe is CVE-2026-104048?

Medium severity, with a CVSS score of 6.8, published 6 October 2026.

Is there a fix for CVE-2026-104048?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104048 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104048?

Check whether you run Red Hat SSSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104048: SSSD authorization bypass via username collision in HBAC

CVE-2026-104048 · Severity: medium · CVSS 6.8 · Published 2026-10-06

SSSD is an identity management daemon that enforces Host-Based Access Control (HBAC) policies to restrict which users can access protected hosts and services. A flaw in how SSSD evaluates these policies in trusted domain environments allows an authenticated user in a trusted domain to bypass access restrictions if their username matches a local account explicitly listed in an allow rule, potentially gaining unauthorized access to protected systems.

Technologies: Red Hat SSSD. Vendors: Red Hat.

Quick answers

Is CVE-2026-104048 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104048 being exploited in the wild.
How severe is CVE-2026-104048?: Medium severity, with a CVSS score of 6.8, published 6 October 2026.
Which products and versions are affected?: Red Hat SSSD <UNKNOWN>.
Is there a fix for CVE-2026-104048?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104048 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104048?: Check whether you run Red Hat SSSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SSSD improperly evaluates HBAC rules in cross-realm trust deployments by stripping domain qualifiers from usernames and comparing only short usernames, leading to CWE-1025 (Comparison Using Wrong Factors). An authenticated user in a trusted domain with a username matching a local Identity Management user listed in an allow rule can bypass HBAC restrictions. Exploitation requires a non-default trust configuration and username collision between domains; unauthenticated remote exploitation is not possible.

Affected products

Red Hat SSSD <UNKNOWN>

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.