CVE-2026-104040

✕ Withdrawn — historical dataMEDIUMNVD 6.1
6.1CVSS

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

CVSS v3
6.1
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

October 6, 2026

Last Modified

November 5, 2026

References (2)

Frequently asked(4)

What is CVE-2026-104040?
CVE-2026-104040 is a rejected CVE ID: its record was withdrawn on November 6, 2026 and no longer describes a vulnerability. Reason given: Red Hat Product Security has been notified that this CVE is a duplicated of CVE-2026-104047
When was the CVE record for CVE-2026-104040 published?
The CVE record for CVE-2026-104040 was published on October 6, 2026. EchelonGraph's copy of the record carries a last-modified date of November 5, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-104040?
CVE-2026-104040 has a CVSS v3 base score of 6.1 (NVD).
How do I remediate CVE-2026-104040?
There is nothing to remediate under CVE-2026-104040: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.