Description
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access via Account Expiration Bypass
Action: Apply Patch
AI Analysis

Impact

SSSD fails to treat an LDAP shadow expiration value of zero as an expired account, allowing a user who can present valid credentials for such an account to authenticate successfully. The weakness is an improper sign conversion (CWE-193) that permits bypass of access controls and persists unauthorized access after an account should be deactivated.

Affected Systems

Red Hat Enterprise Linux 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4 are affected; specific impacted versions are not enumerated in the advisory.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, so the current exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by authenticating with a valid credential set tied to an LDAP account whose expiration attribute is set to zero, thereby bypassing the intended deactivation. The attack can be carried out over the network if LDAP credentials are available, and does not require privilege escalation beyond the granted account rights.

Generated by OpenCVE AI on October 6, 2026 at 01:24 UTC.

Remediation

Vendor Workaround

Until a fix is available, deployments using SSSD's LDAP shadow-based expiration (access_provider = ldap with ldap_access_order including expire and ldap_account_expire_policy = shadow) should not rely on shadowExpire=0 to expire accounts. Set the shadowExpire attribute to a positive past day value so that SSSD correctly treats the account as expired, or enforce account disablement or expiration through directory-side controls that do not depend solely on this client-side SSSD check. If SSSD has cached the affected account's attributes, invalidate the cached entry (for example with sss_cache -u <username>) or restart the sssd service so the updated directory values take effect; note that restarting the service or clearing cached data can briefly interrupt active authentication sessions on the host.

OpenCVE Recommended Actions

  • Apply the vendor security update that fixes the SSSD LDAP expiration bug.
  • After updating, ensure that the LDAP shadow expiration policy is correctly enforced in SSSD and that accounts with a zero expiration value are treated as expired.
  • Review existing LDAP accounts for a zero expiration attribute and disable or adjust them until the patch is applied.

Generated by OpenCVE AI on October 6, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Sssd
Sssd sssd
Vendors & Products Redhat openshift Container Platform
Sssd
Sssd sssd

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.
Title Sssd: sssd: access control bypass via improper ldap shadow expiration check
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-193
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Redhat Enterprise Linux Openshift Openshift Container Platform
Sssd Sssd
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-16T10:57:29.754Z

Reserved: 2026-10-01T17:21:11.078Z

Link: CVE-2026-104033

cve-icon Vulnrichment

Updated: 2026-10-07T20:09:59.716Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-06T01:16:34.143

Modified: 2026-10-07T21:17:07.780

Link: CVE-2026-104033

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T23:29:59Z

Links: CVE-2026-104033 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:56:28Z

Weaknesses