https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-104046.htmlhttps://patchthecve.com/cve/CVE-2026-104046.htmlTue, 13 Oct 2026 15:35:28 +0000MEDIUM 6.2: A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unhttps://patchthecve.com/cve/CVE-2026-104045.htmlhttps://patchthecve.com/cve/CVE-2026-104045.htmlTue, 13 Oct 2026 15:35:49 +0000MEDIUM 4.7: A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memohttps://patchthecve.com/cve/CVE-2026-104048.htmlhttps://patchthecve.com/cve/CVE-2026-104048.htmlFri, 09 Oct 2026 12:54:42 +0000MEDIUM 6.8: A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account https://patchthecve.com/cve/CVE-2026-104047.htmlhttps://patchthecve.com/cve/CVE-2026-104047.htmlFri, 09 Oct 2026 12:56:28 +0000MEDIUM 5.3: A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorizedhttps://patchthecve.com/cve/CVE-2026-88252.htmlhttps://patchthecve.com/cve/CVE-2026-88252.htmlTue, 20 Oct 2026 19:39:08 +0000MEDIUM 4.7: A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connectiohttps://patchthecve.com/cve/CVE-2026-104040.htmlhttps://patchthecve.com/cve/CVE-2026-104040.htmlFri, 16 Oct 2026 21:19:16 +0000MEDIUM 4.4: A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted shttps://patchthecve.com/cve/CVE-2026-90462.htmlhttps://patchthecve.com/cve/CVE-2026-90462.htmlWed, 07 Oct 2026 13:41:47 +0000MEDIUM 5.4: A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, phttps://patchthecve.com/cve/CVE-2026-90996.htmlhttps://patchthecve.com/cve/CVE-2026-90996.htmlWed, 07 Oct 2026 14:29:19 +0000MEDIUM 4.0: A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affectshttps://patchthecve.com/cve/CVE-2026-90995.htmlhttps://patchthecve.com/cve/CVE-2026-90995.htmlWed, 14 Oct 2026 18:05:58 +0000MEDIUM 5.5: A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted frohttps://patchthecve.com/cve/CVE-2026-6245.htmlhttps://patchthecve.com/cve/CVE-2026-6245.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.5: A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an