CVE-2026-104046: 
NixOS vulnerability analysis and mitigation

CVE-2026-104046 is a Denial of Service vulnerability in SSSD (System Security Services Daemon) caused by unbounded memory growth in the Identity Provider (IdP) pre-authentication flow. When IdP authentication is enabled, pre-authentication requests allocate per-request state in an open_request_table hash table that is never cleared or timed out if the corresponding AUTHENTICATE step is never completed. A local attacker can repeatedly initiate PREAUTH flows without completing them, causing unbounded memory consumption that can degrade or terminate SSSD authentication services. Affected products include Red Hat's sssd package (specifically sssd-2.12.0-1.el10), openshift/ose-rhel-coreos-8, and openshift/ose-rhel-coreos-9. The vulnerability was reported on 2026-05-18 and publicly disclosed on 2026-10-06, with a CVSS v3.1 base score of 6.2 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the IdP authentication backend, specifically in src/providers/idp/idp_auth_eval.c (eval_device_auth_buf()), src/providers/idp/idp_auth.c (get_stored_request_data()), and src/providers/idp/idp_init.c (sssm_idp_auth_init()). During a successful PREAUTH device-authorization reply, eval_device_auth_buf() allocates a struct idp_open_req_data object and stores it in open_request_table (a process-lifetime hash table) keyed by user_code, with no size limit, timeout, or eviction policy. Cleanup only occurs in get_stored_request_data() during the SSS_PAM_AUTHENTICATE step — if AUTHENTICATE is never submitted, the stale entry persists indefinitely. An attacker with local access to a PAM authentication surface can exploit this by repeatedly triggering PREAUTH flows that produce fresh user_code values while never completing AUTHENTICATE, growing the table over time and exhausting backend memory (Red Hat Bugzilla).

Successful exploitation results in memory exhaustion of the SSSD backend process, which can degrade or terminate SSSD authentication services, causing a Denial of Service (DoS) for all users relying on SSSD for authentication on the affected host. There is no confidentiality or integrity impact — the vulnerability does not enable unauthorized access, data exposure, or privilege escalation. The impact is scoped to the affected SSSD backend process and is limited to systems where IdP authentication is explicitly configured (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a PAM authentication surface with IdP authentication enabled — a non-default configuration — making opportunistic exploitation unlikely (Red Hat CVE).

1. Identify a target: Locate a system running sssd-2.12.0-1.el10 (or an affected SSSD version) with IdP authentication enabled (idp_* options configured in sssd.conf).
2. Gain local access: Obtain local access to the target system sufficient to reach a PAM authentication surface handled by SSSD (e.g., a login prompt, su, or SSH with PAM).
3. Initiate repeated PREAUTH flows: Repeatedly trigger the PREAUTH (device authorization) step against the IdP-enabled SSSD domain. Each successful PREAUTH call causes SSSD to allocate a new idp_open_req_data entry in open_request_table keyed by a fresh user_code.
4. Withhold AUTHENTICATE: Do not complete the OAuth2 device authorization flow (i.e., never submit the user_code in the AUTHENTICATE step). This prevents the cleanup path in get_stored_request_data() from freeing the allocated entry.
5. Monitor memory growth: Observe the SSSD backend process RSS growing over time (e.g., while true; do ps -o pid,rss,cmd -p <sssd_pid>; sleep 2; done).
6. Achieve DoS: Continue until the SSSD backend process exhausts available memory, causing authentication service degradation or termination for all users on the system (Red Hat Bugzilla).

• Logs: SSSD debug logs (/var/log/sssd/) showing repeated successful PREAUTH handling (device-authorization replies) for the same or different users with no corresponding AUTHENTICATE entries; entries from eval_device_auth_buf() without matching get_stored_request_data() calls.
• Process: Steadily increasing RSS (Resident Set Size) of the SSSD backend process (sssd_be) over time without a corresponding increase in legitimate authentication activity; process termination due to OOM (Out of Memory) killer.
• System: OOM killer events in /var/log/messages or dmesg targeting sssd_be; authentication failures for all users following SSSD backend crash.
• File System: Unusually high memory usage reported by systemd-cgtop or top for the sssd service unit (Red Hat Bugzilla).

Red Hat has not released a patched package version as of the disclosure date, and states that currently available mitigation options do not meet their criteria for ease of use and deployment. The recommended interim mitigations are: (1) disable IdP authentication configuration where possible, as systems not using IdP auth are not exposed to this code path; (2) restrict access to PAM services that exercise the IdP PREAUTH flow to trusted users; and (3) restart the SSSD backend service (systemctl restart sssd) if memory growth is observed, to reclaim accumulated stale entries. A proposed code fix (not yet released) involves adding a maximum pending request cap of 1,024 entries and a 300-second expiry for stored device auth requests in idp_auth_eval.c and idp_auth.c (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported via Red Hat's coordinated disclosure process. Red Hat has classified the impact as Moderate, noting that the local-only attack vector and non-default IdP configuration requirement limit its severity. No significant public researcher commentary or media coverage has been identified beyond the official Red Hat and GitHub advisory publications (Red Hat CVE, GitHub Advisory).