8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46689

CVE-2026-46689: Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery> extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46689

CVE-2026-46689:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
scim_proto	rust	<= 1.9.2	1.9.3
kanidm_proto	rust	<= 1.9.2	1.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stack exhaustion flaw in the SCIM filter parsing logic of the kanidm identity management system. The root cause is an uncontrolled recursion in the PEG (Parsing Expression Grammar) parser, which is used to process SCIM filter strings from incoming HTTP requests. The parser, defined using the peg::parser! macro in Rust, had rules for nested expressions that could be called recursively without any depth limit.

An unauthenticated attacker can exploit this by sending a GET request to a SCIM endpoint with a filter query parameter containing a deeply nested expression (e.g., thousands of nested parentheses). This forces the parser into a deep recursion, which quickly exhausts the thread's stack space. In Rust, a stack overflow is a fatal condition that leads to an immediate process abort, not just a panic that could be caught. This results in a denial of service for the entire kanidmd process, terminating all active sessions and requests.

The vulnerability exists in two separate but nearly identical parser implementations within the scim_proto and kanidm_proto crates. The patch addresses the issue by introducing a maximum recursion depth (SCIM_FILTER_MAX_DEPTH) and modifying the parser rules to enforce this limit, preventing the stack from being exhausted.

Vulnerable functions

scim_proto::filter::scimfilter::parse

libs/scim_proto/src/filter.rs

The `parse` function, generated by the `peg::parser!` macro, is responsible for parsing SCIM filter strings. It uses recursion to handle nested filter expressions. The vulnerability lies in the fact that this recursion was unbounded, allowing an attacker to provide a deeply nested filter string that would exhaust the stack, causing the entire process to crash. The patch mitigates this by introducing a depth limit to the recursion.

scim_proto::filter::scimfilter::parse_complex

libs/scim_proto/src/filter.rs

Similar to the `parse` function, `parse_complex` is also generated by the `peg::parser!` macro and is used for parsing complex SCIM filter attributes. It also suffered from an uncontrolled recursion vulnerability, which could be exploited to cause a stack overflow and a denial of service. The patch applies the same depth-limiting fix to this function.

kanidm_proto::scim::v1::scimfilter::parse

proto/src/scim_v1/mod.rs

This is another instance of the same vulnerable `parse` function, but within the `kanidm_proto` crate. It has the same uncontrolled recursion issue as its counterpart in `scim_proto`, leading to a stack exhaustion vulnerability when parsing deeply nested SCIM filters. The fix is identical, introducing a recursion depth limit.

kanidm_proto::scim::v1::scimfilter::parse_complex

proto/src/scim_v1/mod.rs

This `parse_complex` function in the `kanidm_proto` crate is also vulnerable to the same uncontrolled recursion as the other identified functions. It is used for parsing complex filter attributes and could be exploited to cause a denial of service through stack overflow. The patch addresses this by adding a depth limit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.