CVE-2026-104040

Name of the Vulnerable Software and Affected Versions SSSD (affected versions not specified)

Description An OData injection flaw exists when SSSD is configured with the Entra ID identity provider. Input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this by submitting a crafted search request to alter query filters and broaden user or group searches. This may result in information disclosure through the retrieval of unintended directory objects or a Denial of Service (DoS) caused by excessive processing and cache population.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.