System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0076 advisory.

    This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 8.6. It addresses 9 CVEs:
    CVE-2010-4341, CVE-2010-2940, CVE-2012-3462, CVE-2011-1758, CVE-2023-3758, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1328 advisory.

    This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 9.6. It addresses 11 CVEs:
    CVE-2018-16838, CVE-2010-4341, CVE-2010-2940, CVE-2017-12173, CVE-2025-11561, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0443 advisory.

    This advisory aggregates security fixes for the sssd SRPM in CIQ LTS 9.2. It addresses 11 CVEs:
    CVE-2010-4341, CVE-2010-2940, CVE-2012-3462, CVE-2011-1758, CVE-2018-16838, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fixes CVE-2010-0014 - SSSD accepts any password when offline with a valid TGT available

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
357983	Rocky Linux 8.6 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (ciqsa-2026_0076)	Nessus	Rocky Linux Local Security Checks	Local	high
355548	Rocky Linux 9.6 [CIQ] Security Update: libipa_hbac / libsss_autofs / libsss_certmap / libsss_idmap / etc Multiple Vulnerabilities (ciqsa-2026_1328)	Nessus	Rocky Linux Local Security Checks	Local	high
355472	Rocky Linux 9.2 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (ciqsa-2026_0443)	Nessus	Rocky Linux Local Security Checks	Local	high
47185	Fedora 11 : sssd-1.0.1-1.fc11 (2010-0451)	Nessus	Fedora Local Security Checks	Local	low
47183	Fedora 12 : sssd-1.0.1-1.fc12 (2010-0413)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2010-0014

critical

Tenable Plugins

high

high

high

low

low