RHSA-2026:77534MediumCVSS 7.5

Red Hat Security Advisory: sssd security update

Published
October 8, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-87853 →

📋 Description

CVE-2026-87853 — sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libipa_hbac-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-0:2.12.0-3.el10_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libipa_hbac-debuginfo-0:2.12.0-3.el10_2.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libsss_autofs-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-0:2.12.0-3.el10_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • libsss_autofs-debuginfo-0:2.12.0-3.el10_2.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Deployments not using the IdP authentication provider (idp_type = keycloak) are not affected. For affected deployments: (1) If using Keycloak LDAP federation, switching to Import Users: enabled mode causes Keycloak to assign random UUIDs as sub claims, making prefix collisions astronomically unlikely. (2) Restrict PAM login to specific users via simple_allow_users or access_provider = simple. (3) Disable Keycloak self-registration to prevent attackers from creating accounts with chosen prefix usernames.

🔗 References (4)