CVE-2026-104048 is a Medium severity access control flaw in SSSD. In identity management environments with a trust, SSSD evaluates Host-Based Access Control rules by stripping the domain and comparing only short usernames. A trusted domain user who shares a name with an authorized local account can bypass the policy. Check your vendor for a fix.
What's affected
- Product: SSSD, the System Security Services Daemon, as shipped by Fedora and Red Hat. The record also lists Red Hat Enterprise Linux and OpenShift Container Platform.
- Affected: versions are not listed in the record. Red Hat's page does not give a fixed version in the text I read.
- Fixed: not confirmed. Check Red Hat's CVE page for current errata.
- Precondition: a non-default trust deployment with an account name collision between the local and trusted domains.
- Score: CVSS 6.8, Medium. Red Hat rates it Moderate.
How to check if you're exposed
This only matters if your environment combines IPA or IdM, a cross realm trust to another directory, and HBAC rules that name individual users.
sssctl domain-list
ipa trust-find
ipa hbacrule-find --all
The first command shows the domains SSSD knows. The other two run on an IdM server and list trusts and rules. Look at each HBAC rule that allows access. If a rule lists a specific local user by name, rather than a group, and a trusted domain contains an account with the same short name, the conditions described by Red Hat are met.
Red Hat's statement says environments with no cross realm trusts, or that use group based HBAC policies, are not exposed.
What to do now
- Check whether you run a trust at all. If not, this issue does not apply to you.
- If you do, list HBAC rules that allow access by individual username.
- Rewrite those rules to use groups, which Red Hat's statement says are not exposed.
- Compare user names across the local and trusted domains and resolve any collisions.
- Watch Red Hat's CVE page and your errata feed, and apply the SSSD update when it is published.
- Log and review access to sensitive hosts for logins by trusted domain users that you do not expect.
Why it matters
The record lists CWE-1025, comparison using wrong factors. SSSD normalises both the requesting user and the user named in the rule to a short name, so the domain part that tells two people apart is thrown away before the comparison.
Red Hat rates the issue Moderate because it needs an unusual setup and an authenticated trusted domain user. It cannot be used by anonymous attackers. Even so, access control bugs matter more than the score suggests, because they quietly turn a deny into an allow, and nothing fails visibly.
The record does not list this CVE as exploited in the wild. The lesson is about identity: names without their domain are not identities. Wherever you can, write rules against groups and fully qualified principals.
Quick check
Who is exposed?
Environments with an IdM trust, HBAC allow rules that name a local user directly, and a trusted domain account with the same short name.
Is there a simple mitigation?
Red Hat says group based HBAC policies are not exposed. It also says no mitigation meeting its criteria is available, so watch for the update.
Sources
Last reviewed: 18 October 2026.
