{"id":"CVE-2026-127101","kind":"vulnerability","aliases":["CVE-2026-127101"],"related":[],"title":"SSSD: crafted PAM request crashes authentication responder, denying logins","description":"A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.","summary":"SSSD's PAM responder dereferences a NULL protocol-version pointer when an authentication request arrives before the client protocol version is negotiated. A local attacker can crash the responder and, by repeating crafted requests, keep SSSD-backed authentication down.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","pam","self-hosted","sssd"],"not_affected_if":["no-local-access","no-sssd"],"how_to_check":"- Check the installed SSSD version with `sssd --version` or `rpm -q sssd` / `dpkg -l sssd`\n- Confirm whether PAM authentication goes through SSSD by looking for `sss` in `/etc/nsswitch.conf` and `pam_sss` in `/etc/pam.d/`","fix":null,"status":"open","published_at":"2026-11-12T18:17:41+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:58+00:00","updated_at":"2026-11-12T18:42:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T18:42:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SSSD: crafted PAM request crashes authentication responder, denying logins","impact":"low","summary":"SSSD's PAM responder dereferences a NULL protocol-version pointer when an authentication request arrives before the client protocol version is negotiated. A local attacker can crash the responder and, by repeating crafted requests, keep SSSD-backed authentication down.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sssd","linux","pam","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker crashes SSSD, disrupting logins","analyst_note":"Check the NVD entry and the SSSD upstream advisory for affected and fixed versions; the sources given name no product ranges.","how_to_check":"- Check the installed SSSD version with `sssd --version` or `rpm -q sssd` / `dpkg -l sssd`\n- Confirm whether PAM authentication goes through SSSD by looking for `sss` in `/etc/nsswitch.conf` and `pam_sss` in `/etc/pam.d/`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sssd","no-local-access"],"who_is_affected":"Systems on Linux that authenticate users through SSSD's PAM responder are exposed. The attacker needs local access to the machine to send the request, so hosts with no local user access carry lower risk. Systems that do not use SSSD for PAM authentication can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000743,"input_tokens":4534,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127101':12A,15A '-2026':11A,14A 'arriv':38B 'attack':48B,74C 'authent':6A,36B,62B,78C,102C 'back':61B,101C 'client':41B,84C 'craft':2A,56B,104C 'crash':5A,50B,97C 'cve':10A,13A 'deni':8A 'denial':109C 'derefer':27B,89C 'disrupt':98C 'first':81C 'flaw':64C 'found':66C 'host':21B 'infrastructur':16B 'keep':58B 'linux':17B 'local':47B,73C 'login':9A 'negoti':45B,82C 'null':29B,91C 'pam':3A,18B,25B,70C 'pointer':33B,95C 'protocol':31B,42B,85C,93C 'protocol-vers':30B,92C 'repeat':55B,103C 'request':4A,37B,57B,79C,105C 'respond':7A,26B,52B,71C,88C 'self':20B 'self-host':19B 'send':76C 'servic':111C 'sssd':1A,22B,23B,60B,68C,100C 'sssd-back':59B,99C 'sustain':107C 'version':32B,43B,86C,94C 'without':80C","nicknames":[],"mitigations":[],"who_affected":"Systems on Linux that authenticate users through SSSD's PAM responder are exposed. The attacker needs local access to the machine to send the request, so hosts with no local user access carry lower risk. Systems that do not use SSSD for PAM authentication can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linux","medium","pam","selfhosted","sssd"],"campaign_type":null,"search_a":"'-127101':12A,15A '-2026':11A,14A 'authent':6A 'craft':2A 'crash':5A 'cve':10A,13A 'deni':8A 'login':9A 'pam':3A 'request':4A 'respond':7A 'sssd':1A","search_b":"'arriv':38B 'attack':48B 'authent':36B,62B 'back':61B 'client':41B 'craft':56B 'crash':50B 'derefer':27B 'host':21B 'infrastructur':16B 'keep':58B 'linux':17B 'local':47B 'negoti':45B 'null':29B 'pam':18B,25B 'pointer':33B 'protocol':31B,42B 'protocol-vers':30B 'repeat':55B 'request':37B,57B 'respond':26B,52B 'self':20B 'self-host':19B 'sssd':22B,23B,60B 'sssd-back':59B 'version':32B,43B","search_c":"'attack':74C 'authent':78C,102C 'back':101C 'client':84C 'craft':104C 'crash':97C 'denial':109C 'derefer':89C 'disrupt':98C 'first':81C 'flaw':64C 'found':66C 'local':73C 'negoti':82C 'null':91C 'pam':70C 'pointer':95C 'protocol':85C,93C 'protocol-vers':92C 'repeat':103C 'request':79C,105C 'respond':71C,88C 'send':76C 'servic':111C 'sssd':68C,100C 'sssd-back':99C 'sustain':107C 'version':86C,94C 'without':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127101","severity":null,"published_at":"2026-11-12T18:17:41+00:00","modified_at":"2026-11-12T18:17:41+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}