Vulnerability in scim_proto (CVE-2026-46689)
Summary
Vulnerability in scim_proto (CVE-2026-46689). Risk of unauthorized operations or information disclosure. Exploitable via GET. Mitigation: upgrade to 1.9.3 or later.
Original description
The description as published by the source.
Summary
A single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query extractor, before any handler body and therefore before any ACL check.
Details
The SCIM filter grammar recurses on ( and not ( with no depth bound.
proto/src/scim_v1/mod.rs:263-433 — peg::parser! { grammar scimfilter() ... }:
// line 281
"not" separator()+ "(" e:parse() ")" { ScimFilter::Not(Box::new(e)) }
// line 293
"(" e:parse() ")" { e }
Both rules re-enter parse() without a depth counter.
proto/src/scim_v1/mod.rs:442-447 — impl FromStr for ScimFilter calls scimfilter::parse(input) directly on the raw string with no length or depth pre-check.
proto/src/scim_v1/mod.rs:80-81 — ScimEntryGetQuery.filter is #[serde_as(as = "Option")], so deserialising the query struct invokes ScimFilter::from_str on attacker bytes.
Unauthenticated reachability — nine handlers in server/core/src/https/v1_scim.rs (route table at lines 865-1029) take Query as an argument: /scim/v1/Entry, /scim/v1/Entry/{id}, /scim/v1/Person/{id}, /scim/v1/Application, /scim/v1/Application/{id}, /scim/v1/Class, /scim/v1/Attribute, /scim/v1/Message, `/scim/v1/Messag…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-46689 has been found in scim_proto.
Attackers can target a specific entry point like GET over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade scim_proto to 1.9.3 or later.
If unsure, ask your IT team or search "scim_proto CVE-2026-46689" on the vendor's site.
CVE-2026-46689 (scim_proto) — CWE-248
Attack surface: GET / kanidmd / ScimEntryGetQuery.filter / VerifiedClientInformation
Patched: 1.9.3 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-248) exists in scim_proto. Attackers reach the vulnerable code path via GET.
Check the vendor advisory for the affected versions of scim_proto. Attack surface: GET / kanidmd / ScimEntryGetQuery.filter / VerifiedClientInformation.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 1.9.3.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'scim_proto' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'scim_proto' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
scim_protoを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade scim_proto to 1.9.3ステージング環境で 1.9.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com