Is CVE-2026-127100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127100 being exploited in the wild.

How severe is CVE-2026-127100?

Medium severity, with a CVSS score of 5.5, published 12 November 2026.

Which products and versions are affected?

Red Hat SSSD Affected in RHEL 9.8+ and RHEL 10.2+.

Is there a fix for CVE-2026-127100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-127100 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-127100?

Check whether you run Red Hat SSSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127100: SSSD PAM responder NULL pointer dereference in JSON extension

CVE-2026-127100 · Severity: medium · CVSS 5.5 · Published 2026-11-12

A flaw in SSSD's PAM responder authentication module causes it to crash when processing maliciously crafted login requests on systems with the JSON PAM extension enabled. A local attacker can trigger this denial of service to disrupt authentication for users relying on SSSD, preventing them from logging in until the service is manually restarted.

Technologies: Red Hat SSSD. Vendors: Red Hat.

Quick answers

Is CVE-2026-127100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127100 being exploited in the wild.
How severe is CVE-2026-127100?: Medium severity, with a CVSS score of 5.5, published 12 November 2026.
Which products and versions are affected?: Red Hat SSSD Affected in RHEL 9.8+ and RHEL 10.2+.
Is there a fix for CVE-2026-127100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-127100 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-127100?: Check whether you run Red Hat SSSD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a NULL pointer dereference (CWE-476) in SSSD's PAM responder when the JSON PAM extension is enabled. An attacker with local access can send a crafted authentication request with a non-string OAuth2 code value, bypassing JSON type validation and causing the PAM responder process to crash. This results in denial of service of SSSD-backed authentication with no confidentiality or integrity impact.

Affected products

Red Hat SSSD Affected in RHEL 9.8+ and RHEL 10.2+

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.