CVE-2026-46689: Kanidm

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery> extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3.

Affected products

• Kanidm Kanidm: before 1.9.3 (fixed in 1.9.3)

Published 2026-06-10. Last modified 2026-07-23.