{"id":"CVE-2026-127100","kind":"vulnerability","aliases":["CVE-2026-127100"],"related":[],"title":"SSSD: crafted PAM request crashes authentication responder on JSON builds","description":"A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.","summary":"SSSD's PAM responder, when built with the JSON PAM extension, dereferences a NULL pointer if an authentication request carries a non-string OAuth2 code value. A local attacker can crash the responder and disrupt SSSD-backed logins.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sssd","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","linux","pam","self-hosted","sssd"],"not_affected_if":["default-build","no-local-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T18:17:40+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:43:01+00:00","updated_at":"2026-11-12T18:43:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-12T18:43:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SSSD: crafted PAM request crashes authentication responder on JSON builds","impact":"low","summary":"SSSD's PAM responder, when built with the JSON PAM extension, dereferences a NULL pointer if an authentication request carries a non-string OAuth2 code value. A local attacker can crash the responder and disrupt SSSD-backed logins.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sssd","linux","pam","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"PAM responder crashes, disrupting SSSD-backed authentication logins","analyst_note":"Find affected and fixed SSSD versions and how to confirm the JSON PAM extension is enabled, from the NVD page or the SSSD project advisory.","how_to_check":"- unknown","plain_action":"","product_name":"sssd","needs_analyst":true,"not_affected_if":["default-build","no-local-access"],"who_is_affected":"Only systems running SSSD with a build that has the JSON PAM extension enabled are exposed, and the attacker needs local access to submit the crafted request. Systems using SSSD without that extension, or without local untrusted users, are less exposed. The sources do not name the affected versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4562,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127100':13A,16A '-2026':12A,15A 'attack':54B,84C 'authent':6A,42B,89C,118C 'back':63B,117C 'build':10A,75C 'built':30B 'carri':44B 'code':50B,97C 'contain':91C 'craft':2A,88C 'crash':5A,56B 'cve':11A,14A 'derefer':36B,108C 'disrupt':60B,114C 'enabl':81C 'extens':35B,80C 'flaw':66C 'found':68C 'host':23B 'infrastructur':18B 'json':9A,33B,78C,100C 'lead':103C 'linux':19B 'local':53B,83C 'login':64B 'miss':99C 'non':47B,94C 'non-str':46B,93C 'null':38B,106C 'oauth2':49B,96C 'pam':3A,20B,27B,34B,72C,79C,111C 'pointer':39B,107C 'request':4A,43B,90C 'respond':7A,28B,58B,73C,112C 'self':22B 'self-host':21B 'sssd':1A,17A,24B,25B,62B,70C,116C 'sssd-back':61B,115C 'string':48B,95C 'submit':86C 'termin':109C 'type':101C 'valid':102C 'valu':51B,98C","nicknames":[],"mitigations":[],"who_affected":"Only systems running SSSD with a build that has the JSON PAM extension enabled are exposed, and the attacker needs local access to submit the crafted request. Systems using SSSD without that extension, or without local untrusted users, are less exposed. The sources do not name the affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["sssd"],"ptokens":["sssd"],"labels":["infrastructure","linux","medium","pam","selfhosted","sssd","vendor"],"campaign_type":null,"search_a":"'-127100':13A,16A '-2026':12A,15A 'authent':6A 'build':10A 'craft':2A 'crash':5A 'cve':11A,14A 'json':9A 'pam':3A 'request':4A 'respond':7A 'sssd':1A,17A","search_b":"'attack':54B 'authent':42B 'back':63B 'built':30B 'carri':44B 'code':50B 'crash':56B 'derefer':36B 'disrupt':60B 'extens':35B 'host':23B 'infrastructur':18B 'json':33B 'linux':19B 'local':53B 'login':64B 'non':47B 'non-str':46B 'null':38B 'oauth2':49B 'pam':20B,27B,34B 'pointer':39B 'request':43B 'respond':28B,58B 'self':22B 'self-host':21B 'sssd':24B,25B,62B 'sssd-back':61B 'string':48B 'valu':51B","search_c":"'attack':84C 'authent':89C,118C 'back':117C 'build':75C 'code':97C 'contain':91C 'craft':88C 'derefer':108C 'disrupt':114C 'enabl':81C 'extens':80C 'flaw':66C 'found':68C 'json':78C,100C 'lead':103C 'local':83C 'miss':99C 'non':94C 'non-str':93C 'null':106C 'oauth2':96C 'pam':72C,79C,111C 'pointer':107C 'request':90C 'respond':73C,112C 'sssd':70C,116C 'sssd-back':115C 'string':95C 'submit':86C 'termin':109C 'type':101C 'valid':102C 'valu':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127100","severity":null,"published_at":"2026-11-12T18:17:40+00:00","modified_at":"2026-11-12T18:17:41+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}