PT-2026-41980 · Kanidm+1 · Kanidm+2

Published 2026-05-06 · Updated 2026-06-10 · CVE-2026-46689

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kanidm versions prior to 1.9.3

Description An unauthenticated GET request to any /scim/v1/... endpoint using a ?filter= query string containing several thousand nested parentheses (approximately 4–12 KB) can cause a stack overflow. This occurs because the recursive-descent PEG parser lacks a depth bound when processing the SCIM filter grammar. The parsing process happens within the Query<ScimEntryGetQuery> extractor before any handler body or Access Control List (ACL) check is performed. Consequently, the Rust runtime triggers std::process::abort(), causing the entire kanidmd process to exit and resulting in a complete loss of service availability. Affected endpoints include /scim/v1/Entry, /scim/v1/Entry/{id}, /scim/v1/Person/{id}, /scim/v1/Application, /scim/v1/Application/{id}, /scim/v1/Class, /scim/v1/Attribute, /scim/v1/Message, and /scim/v1/Message/{id}.

Recommendations Update to version 1.9.3.

Fix

Resource Exhaustion

Uncontrolled Recursion

Weakness Enumeration

CWE-400

CWE-674

CWE-248

Related Identifiers

CVE-2026-46689

GHSA-R5FR-9GMV-JGGH

Affected Products

Kanidm

Kanidm Proto

Scim Proto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-46689 · Security Note
• https://osv.dev/vulnerability/GHSA-r5fr-9gmv-jggh · Vendor Advisory
• https://github.com/kanidm/kanidm · Note
• https://github.com/kanidm/kanidm/security/advisories/GHSA-r5fr-9gmv-jggh · Note
• https://github.com/kanidm/kanidm/releases/tag/v1.9.3 · Note