CVE-2026-90462
Received Received - Intake

SSSD LDAP ppolicy Access Control Bypass

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: redhat-SADP

Description
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-90462
EUVD
EUVD-2026-84537

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat sssd *
redhat sssd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-280 The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90462 is a flaw in SSSD where deleted or deprovisioned users retain unauthorized access under specific LDAP configurations. When SSSD uses the LDAP access provider with `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition occurs if a user lookup returns zero results. This incorrectly grants access and caches an allow decision, letting deleted users maintain authorization.

Detection Guidance

Check SSSD logs for failed user lookups or unexpected access grants. Use commands like 'sssd --genconf' to verify LDAP access provider settings and 'ldapsearch' to test user lookups. Inspect SSSD cache with 'sss_cache -E' and review 'ldap_access_order' in SSSD config files.

Impact Analysis

This vulnerability allows deleted or deprovisioned users to retain access to systems and resources they should no longer have. It could lead to unauthorized access to sensitive information, potential data leaks, or limited modifications to resources. Exploitation requires prior valid account context and specific non-default LDAP configurations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control. GDPR requires strict access controls and timely revocation of user access, while HIPAA mandates safeguards to protect patient data. Unauthorized access due to this flaw may result in non-compliance with these regulations.

Mitigation Strategies

Remove 'ppolicy' or 'lockout' from 'ldap_access_order' in SSSD configuration. Clear stale SSSD cache entries using 'sss_cache -E' and restart SSSD. Monitor for unauthorized access attempts and update SSSD if a patch becomes available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart