RHSA-2026:97438: Moderate: sssd security, bug fix, and enhancement update

Q: Which SSSD-related packages are covered by this advisory?

The listed packages are sssd, sssd-client, sssd-ad, python3-sss, and python3-sss-murmur, including their corresponding debuginfo packages where listed.

Q: Does this update include changes beyond the security fix?

Yes. It includes performance fixes for enumeration and BE_REQ_INITGROUPS handling, as well as enhancements including support for a Microsoft AD PKINIT authentication indicator and GDM support for IdM IdP and MFA.

Published Nov 10, 2026

Updated

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.Security Fix(es): sssd: out-of-bounds read in the sssd (CVE-2026-6245) Bug Fix(es) and Enhancement(s): Performance impact with enumerate in SSSD > 2.7.3 [rhel-9] (JIRA:RHEL-143416) Poor performance of BEREQINITGROUPS handling by 'sssdbe' (LDAP RFC2307, no nested groups) [rhel-9] (JIRA:RHEL-150439) [RFE] SSSD PAM: Support Microsoft AD PKINIT authentication indicator (ms-pkca) for pamgssapiindicatorsmap [rhel-9] (JIRA:RHEL-152067) [RHEL9.9] - GDM Support for IdM IdP feature and MFA [SSSD] (JIRA:RHEL-156519) SSSD Rebase for RHEL 9.9 (JIRA:RHEL-173741) [RHEL9.9] Man page update: man sssdkrb5localauthplugin ? Missing disable = an2ln (JIRA:RHEL-173742) [RHEL9.9] Concurrent child processes trigger unnecessarily backtrace (JIRA:RHEL-173743) [RHEL9.9] Detect foreign security principals in AD group members and silently ignore them (JIRA:RHEL-173744) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Affected Software

161 affected componentsFixes available

redhat/sssd<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sssdconfig<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debugsource<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debugsource<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-polkit-rules<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-polkit-rules<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss-murmur-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ad-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-client-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-common-pac-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-dbus-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-debugsource<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-idp-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ipa-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-kcm-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-common-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-krb5-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-ldap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-nfs-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-passkey-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-polkit-rules<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-proxy-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-tools-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap<2.9.9-3.el9

2.9.9-3.el9

redhat/sssd-winbind-idmap-debuginfo<2.9.9-3.el9

2.9.9-3.el9

redhat/python3-sss<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/python3-sss-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/python3-sss-murmur<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/python3-sss-murmur-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ad<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ad-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-client<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-client-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-common<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-common-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-common-pac<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-common-pac-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-dbus<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-dbus-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-debugsource<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-idp<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-idp-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ipa<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ipa-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-kcm<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-kcm-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-krb5<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-krb5-common<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-krb5-common-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-krb5-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ldap<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-ldap-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-nfs-idmap<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-nfs-idmap-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-passkey<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-passkey-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-polkit-rules<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-proxy<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-proxy-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-tools<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-tools-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-winbind-idmap<2.9.9-3.el9.aa

2.9.9-3.el9.aa

redhat/sssd-winbind-idmap-debuginfo<2.9.9-3.el9.aa

2.9.9-3.el9.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/sssd to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sss to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sss-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sss-murmur to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sss-murmur-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sssdconfig to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ad to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ad-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-client to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-client-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-common to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-common-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-common-pac to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-common-pac-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-dbus to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-dbus-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-debugsource to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-idp to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-idp-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ipa to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ipa-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-kcm to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-kcm-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-krb5 to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-krb5-common to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-krb5-common-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-krb5-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ldap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-ldap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-nfs-idmap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-nfs-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-passkey to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-passkey-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-polkit-rules to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-proxy to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-proxy-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-tools to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-winbind-idmap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/sssd-winbind-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9
Upgrade
Upgrade redhat/python3-sss to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/python3-sss-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/python3-sss-murmur to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/python3-sss-murmur-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ad to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ad-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-client to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-client-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-common to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-common-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-common-pac to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-common-pac-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-dbus to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-dbus-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-debugsource to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-idp to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-idp-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ipa to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ipa-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-kcm to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-kcm-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-krb5 to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-krb5-common to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-krb5-common-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-krb5-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ldap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-ldap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-nfs-idmap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-nfs-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-passkey to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-passkey-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-polkit-rules to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-proxy to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-proxy-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-tools to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-winbind-idmap to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa
Upgrade
Upgrade redhat/sssd-winbind-idmap-debuginfo to a version that resolves this vulnerability.
Fixed in 2.9.9-3.el9.aa

Event History

Nov 10, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which SSSD-related packages are covered by this advisory?

The listed packages are sssd, sssd-client, sssd-ad, python3-sss, and python3-sss-murmur, including their corresponding debuginfo packages where listed.

Does this update include changes beyond the security fix?

Yes. It includes performance fixes for enumeration and BE_REQ_INITGROUPS handling, as well as enhancements including support for a Microsoft AD PKINIT authentication indicator and GDM support for IdM IdP and MFA.

RHSA-2026:97438: Moderate: sssd security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which SSSD-related packages are covered by this advisory?

Does this update include changes beyond the security fix?

Company

Resources

Contact

Frequently Asked Questions

Which SSSD-related packages are covered by this advisory?

Does this update include changes beyond the security fix?