CVE-2026-68743 is a medium severity (CVSS 5.5) out-of-bounds read in SSSD. The PAM responder does not check the auth_token_length field in protocol v1 requests, so a local attacker can crash it and cause denial of service. Check your vendor's errata for the fixed package.
What's affected
The record lists Fedora's SSSD, Red Hat Enterprise Linux and Red Hat OpenShift Container Platform as affected products, without version numbers. The Red Hat CVE page I retrieved also gave no fixed package version in the text I could read, so look up the errata for your exact release in the Red Hat Customer Portal (or your distribution's tracker). I am not stating a fixed version.
The scope is narrow, per Red Hat's statement. The issue can only be triggered by a local attacker who can connect to the PAM responder unix socket and send crafted protocol v1 requests. The stock PAM client uses protocol v3 and is not affected by this path.
On SSSD 2.10 and later the responders run as an unprivileged user. On earlier versions they may run as root. Either way the impact is a crash and denial of service of SSSD-mediated authentication.
How to check if you're exposed
Check which SSSD package you have, and whether it has the vendor fix:
rpm -q sssd
sssd --version
rpm -q --changelog sssd | grep -i "CVE-2026-68743"
On Debian family systems, use dpkg -l sssd. If the changelog mentions the CVE, your build includes a fix. Otherwise compare against the vendor errata.
Then think about who has local access. A server with few local users has a lower exposure than a shared login host. Red Hat lists no available mitigation, so patching is the only control.
A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.
What to do now
- Find the vendor errata for your release, and apply the updated sssd packages.
- Restart the sssd service after updating, or reboot as your change process requires.
- Reduce who has local shell access on hosts where authentication continuity matters.
- Watch for repeated SSSD crashes in the journal, which could signal probing.
- Update container base images that include sssd, since the record lists OpenShift Container Platform.
Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.
Why it matters
The weakness is CWE-125, out-of-bounds read. A length field in the request was trusted without comparing it with the data actually left in the buffer, so the parser read past the end. The result here is a process crash, not a data leak, in the record's description.
A crash in the authentication helper matters more than a typical local denial of service. If login depends on SSSD, a crash can lock users out until the service restarts. The score is moderate because the attacker must be local. The record does not mark this CVE as known exploited.
Quick check
Can a remote attacker use this?
The record and Red Hat describe a local attacker who connects to the responder socket.
Is there a workaround?
Red Hat says no mitigation is available that meets its criteria, so apply the update.
Sources
- https://access.redhat.com/security/cve/CVE-2026-68743
- Record: NVD entry for CVE-2026-68743 (score 5.5, MEDIUM)
Last reviewed: 18 October 2026.
