CVE-2026-127101

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.

• CWE-476

• https://access.redhat.com/security/cve/CVE-2026-127101
• https://bugzilla.redhat.com/show_bug.cgi?id=2572592

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127093Rustrak before 0.26.0 contains a server-side request forgery…5.5
• CVE-2026-127094Pagelayer 2.1.7 before 2.2.1 contains a missing authorizatio…7.6
• CVE-2026-127099A flaw was found in SSSD's conversion of X.509 certificate R…5.9
• CVE-2026-1271The ProfileGrid – User Profiles, Groups and Communities plug…5.3
• CVE-2026-12710A Missing Authorization vulnerability in the QueryEngineTask…9.3
• CVE-2026-127100A flaw was found in SSSD's PAM responder on builds with the …5.5
• CVE-2026-127102In Eclipse BaSyx Go Components versions up to and including …7.1
• CVE-2026-127109A code injection vulnerability in promzard’s template-loadin…
• CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5