CVE-2026-90462
published 2026-09-22CVE-2026-90462: A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the…
PriorityP432medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.18%
7.2th percentile
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
vendor_redhat·2026-09-22·CVSS 5.4
CVE-2026-90462 [MEDIUM] CWE-280 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.
Statement: This Moderate impact flaw in SSSD allows a deleted or deprovisioned user to retain authorization under specific non-default LDAP access co
VulDB
SSSD improper authorization (Nessus ID 364712)
vuldb·2026-10-13·CVSS 5.4
CVE-2026-90462 [MEDIUM] SSSD improper authorization (Nessus ID 364712)
A vulnerability labeled as critical has been found in SSSD. This affects an unknown part. The manipulation results in improper authorization.
This vulnerability is reported as CVE-2026-90462. The attack can be launched remotely. No exploit exists.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-09-22
CVE-2026-90462 [MEDIUM] CWE-280 A flaw was found in SSSD.
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization [fedora-all]
bugzilla·2026-09-22·CVSS 5.4
CVE-2026-90462 [MEDIUM] CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization [fedora-all]
CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Fail-open in LDAP ppolicy access check when user lookup returns
zero results: missing-user LDAP ppolicy lookups can incorrectly return
success and cache an allow decision, permitting continued authorization for
a deleted or deprovisioned user in affected configurations.
Requirements to exploit: SSSD must use `access_provider = ldap` with
`ldap_access_order` including `ppolicy` or `lockout`, the target user mu
Bugzilla
CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
bugzilla·2026-05-18·CVSS 5.4
CVE-2026-90462 [MEDIUM] CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
CVE-2026-90462 sssd: SSSD: Fail-open in LDAP ppolicy access check allows continued authorization
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Fail-open in LDAP ppolicy access check when user lookup returns
zero results: missing-user LDAP ppolicy lookups can incorrectly return
success and cache an allow decision, permitting continued authorization for
a deleted or deprovisioned user in affected configurations.
Requirements to exploit: SSSD must use `access_provider = ldap` with
`ldap_access_order` including `ppolicy` or `lockout`, the target user must
still have locally retained SSSD user state, the ppolicy LDAP lookup for
that user must return zero entries, and a new access check must reach the
online LDAP access path.
Component affected: `sssd-2.12.0-1.el10`,
`src/providers/ldap/s
2026-09-22
Published