CVE-2026-92821
Sssd: sssd: access control bypass via premature ldap access rule evaluation
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Sssd: sssd: access control bypass via premature ldap access rule evaluation
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
CVE-2026-92821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-06
EUVDEUVD-2026-92894
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
EUVD-2026-92894- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-3hrm-ww2w-wqqc
A flaw was found in SSSD. When configured to evaluate password expiration warnings before...
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
GHSA-3hrm-ww2w-wqqc- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-02
NVD
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
CVE-2026-92821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-393
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-92821
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
DEBIAN-CVE-2026-92821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-07
OSVOESA-2026-4711
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS).(CVE-2026-104029)
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.(CVE-2026-104030)
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).(CVE-2026-104031)
A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.(CVE-2026-104032)
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.(CVE-2026-104033)
A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).(CVE-2026-104034)
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.(CVE-2026-104035)
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).(CVE-2026-104037)
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can…
- Record
OESA-2026-4711- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
Show 4 moreShow less
OSVOESA-2026-4712
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS).(CVE-2026-104029)
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.(CVE-2026-104030)
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).(CVE-2026-104031)
A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.(CVE-2026-104032)
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.(CVE-2026-104033)
A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).(CVE-2026-104034)
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.(CVE-2026-104035)
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).(CVE-2026-104037)
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can…
- Record
OESA-2026-4712- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
OSVOESA-2026-4714
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS).(CVE-2026-104029)
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).(CVE-2026-104031)
A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.(CVE-2026-104032)
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.(CVE-2026-104033)
A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).(CVE-2026-104034)
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.(CVE-2026-104035)
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).(CVE-2026-104037)
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate.(CVE-2026-104039)
A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to…
- Record
OESA-2026-4714- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-92821
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
- Record
UBUNTU-CVE-2026-92821- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2026:5079-1 No score
Security update for sssd
This update for sssd fixes the following issues:
- CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).
- CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922).
- CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925).
- CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924).
- CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584).
- CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360).
- CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361).
- CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362).
- CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363).
- CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326).
- CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314).
- CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316).
- CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318).
- CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321).
- CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322).
- CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323).
- CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324).
- CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266).
- CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).
- Record
SUSE-SU-2026:5079-1- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sssdDebian:12 |
All versions, plus listed versions 2.10.1-12.10.1-22.11.1-12.11.1-22.11.1-2.1 Show 22 moreShow less2.12.0-12.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-42.8.2-42.8.2-4+deb12u12.9.1-12.9.1-22.9.2-12.9.4-12.9.4-1.12.9.4-1.1~exp12.9.4-22.9.5-12.9.5-22.9.5-32.9.5-42.9.5-5 |
None known |
sssdDebian:13 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdDebian:14 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdopenEuler:24.03-LTS-SP1 From an advisory covering 16 CVEs |
before 2.9.4-34.oe2403sp1 | 2.9.4-34.oe2403sp1 |
sssdopenEuler:24.03-LTS-SP3 From an advisory covering 16 CVEs |
before 2.9.4-34.oe2403sp3 | 2.9.4-34.oe2403sp3 |
sssdopenEuler:22.03-LTS-SP4 From an advisory covering 14 CVEs |
before 2.6.1-38.oe2203sp4 | 2.6.1-38.oe2203sp4 |
sssdSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 19 CVEs |
before 2.10.2-150600.3.58.1 | 2.10.2-150600.3.58.1 |
sssdSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 19 CVEs |
before 2.10.2-150600.3.58.1 | 2.10.2-150600.3.58.1 |
sssdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.5-21.13.1-21.13.2-11.13.3-11.13.4-1 Show 15 moreShow less1.13.4-1ubuntu11.13.4-1ubuntu1.11.13.4-1ubuntu1.21.13.4-1ubuntu1.51.13.4-1ubuntu1.61.13.4-1ubuntu1.71.13.4-1ubuntu1.81.13.4-1ubuntu1.91.13.4-1ubuntu1.101.13.4-1ubuntu1.111.13.4-1ubuntu1.121.13.4-1ubuntu1.131.13.4-1ubuntu1.141.13.4-1ubuntu1.151.13.4-1ubuntu1.15+esm1 |
None known |
sssdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.15.3-2ubuntu11.15.3-3ubuntu11.16.0-5ubuntu11.16.0-5ubuntu21.16.1-1ubuntu1 Show 9 moreShow less1.16.1-1ubuntu1.11.16.1-1ubuntu1.21.16.1-1ubuntu1.31.16.1-1ubuntu1.41.16.1-1ubuntu1.51.16.1-1ubuntu1.61.16.1-1ubuntu1.71.16.1-1ubuntu1.81.16.1-1ubuntu1.8+esm1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sssdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.2.0-4ubuntu12.2.2-12.2.2-1ubuntu12.2.3-1.1ubuntu12.2.3-2 Show 14 moreShow less2.2.3-32.2.3-3ubuntu0.12.2.3-3ubuntu0.22.2.3-3ubuntu0.32.2.3-3ubuntu0.42.2.3-3ubuntu0.62.2.3-3ubuntu0.72.2.3-3ubuntu0.82.2.3-3ubuntu0.92.2.3-3ubuntu0.102.2.3-3ubuntu0.112.2.3-3ubuntu0.122.2.3-3ubuntu0.132.2.3-3ubuntu0.13+esm1 |
None known |
sssdUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.1-2ubuntu42.5.2-4ubuntu12.5.2-4ubuntu32.5.2-4ubuntu42.6.1-1ubuntu3 Show 9 moreShow less2.6.3-1ubuntu32.6.3-1ubuntu3.12.6.3-1ubuntu3.22.6.3-1ubuntu3.32.6.3-1ubuntu3.42.6.3-1ubuntu3.52.6.3-1ubuntu3.62.6.3-1ubuntu3.82.6.3-1ubuntu3.9 |
None known |
sssdUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.1-2ubuntu22.9.1-2ubuntu32.9.2-1ubuntu22.9.4-1ubuntu12.9.4-1.1ubuntu3 Show 10 moreShow less2.9.4-1.1ubuntu52.9.4-1.1ubuntu62.9.4-1.1ubuntu6.12.9.4-1.1ubuntu6.22.9.4-1.1ubuntu6.32.9.4-1.1ubuntu6.42.9.4-1.1ubuntu6.52.9.4-1.1ubuntu6.62.9.4-1.1ubuntu6.72.9.4-1.1ubuntu6.8 |
None known |
sssdUbuntu:26.10 |
All versions, plus listed versions 2.12.0-1ubuntu52.12.0-4ubuntu12.12.0-4ubuntu22.12.0-4ubuntu32.12.0-4ubuntu4 |
None known |
sssdUbuntu:26.04:LTS |
All versions, plus listed versions 2.10.1-2ubuntu52.10.1-2ubuntu72.12.0-1ubuntu32.12.0-1ubuntu42.12.0-1ubuntu5 Show 5 moreShow less2.12.0-1ubuntu5.12.12.0-1ubuntu5.22.12.0-1ubuntu5.32.12.0-1ubuntu5.42.12.0-1ubuntu5.5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, facts | EUVD, NVD | |
| products | CVE List | |
| affected, aliases, references | OSV | |
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92821 is a medium vulnerability (CVSS 6.8) in Red Hat Enterprise Linux 10, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-92821
bugzilla.redhat.com/show_bug.cgi?id=2479031
nvd.nist.gov/vuln/detail/CVE-2026-92821
github.com/advisories/GHSA-3hrm-ww2w-wqqc
security-tracker.debian.org/tracker/CVE-2026-92821
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4711
Show 59 moreShow less
suse.com/support/update/announcement/2026/suse-su-20265079-1
bugzilla.suse.com/1269807
ubuntu.com/security/CVE-2026-92821
cve.org/CVERecord?id=CVE-2026-92821
Left out here: the rest of 3 source descriptions. The JSON record has them.