Executive brief
Kanidm is an identity management platform used to manage user authentication and access across corporate networks. A vulnerability in its web interface allows an unauthenticated attacker to crash the entire service by sending a specially crafted web request. This results in a total service outage, preventing users from logging into applications, using the web interface, or performing identity-related tasks until the service is manually restarted.
Technical details
A stack exhaustion vulnerability exists in Kanidm's SCIM filter parser. The recursive-descent PEG parser in the kanidm_proto crate fails to enforce a depth limit when processing nested parentheses in the 'filter' query parameter. Because this parsing occurs within an axum extractor before authentication or ACL checks are performed, an unauthenticated remote attacker can trigger a stack overflow. In Rust, this results in an immediate process abort (SIGABRT), bypassing tokio's task-level panic handling and crashing the entire kanidmd daemon. The issue is reachable via multiple /scim/v1/ endpoints and has been patched in version 1.9.3 by implementing depth bounds.
Affected products
- Kanidm Project Kanidm < 1.9.3
Timeline
- 2026-04-30: patched: Version 1.9.3 released
- 2026-06-10: disclosed: CVE-2026-46689 published