CVE-2026-104033— Sssd: sssd: access control bypass via improper ldap shadow expiration check
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 SSSD 中发现一个漏洞。当 SSSD 配置为通过 LDAP（轻量级目录访问协议）阴影属性强制实施账户过期策略时，它不会将过期值零视为已过期账户。拥有过期账户有效凭据的用户可以利用此漏洞绕过访问控制并登录系统。这会导致在账户本应被停用后，仍能持续存在未经授权的访问。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sssd: sssd: access control bypass via improper ldap shadow expiration check
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Off-by-one错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-104033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104033
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-104033 (2)
-
-
🔗 2479271 – (CVE-2026-104033) CVE-2026-104033 sssd: sssd: Access control bypass via improper LDAP shadow expiration check Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-06 · 16 CVEs total
| CVE-2026-92821 | 6.8 MEDIUM | Sssd: sssd: access control bypass via premature ldap access rule evaluation |
| CVE-2026-104044 | 6.2 MEDIUM | Sssd: sssd: denial of service via crafted passkey kerberos authentication request |
| CVE-2026-104038 | 5.9 MEDIUM | Sssd: sssd: denial of service via missing sid extension in certificate mapping |
| CVE-2026-104036 | 5.8 MEDIUM | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin |
| CVE-2026-104043 | 5.5 MEDIUM | Sssd: sssd: denial of service via undersized packet parsing in nss responder |
| CVE-2026-104042 | 5.5 MEDIUM | Sssd: sssd: denial of service via out-of-bounds read in pam responder |
| CVE-2026-104041 | 5.5 MEDIUM | Sssd: sssd: denial of service via unbounded negative cache growth |
| CVE-2026-104037 | 5.5 MEDIUM | Sssd: sssd: denial of service via packet length underflow in autofs responder |
| CVE-2026-104035 | 5.5 MEDIUM | Sssd: sssd: denial of service via memory exhaustion in kcm responder |
| CVE-2026-104032 | 5.5 MEDIUM | Sssd: sssd: denial of service via unprivileged autofs cache invalidation |
| CVE-2026-104031 | 5.5 MEDIUM | Sssd: sssd: denial of service via memory exhaustion in autofs responder |
| CVE-2026-105305 | 5.4 MEDIUM | Keycloak-services: keycloak-services: device authorization grant bypasses per-client minim |
| CVE-2026-104039 | 4.7 MEDIUM | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder |
| CVE-2026-104034 | 4.7 MEDIUM | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal |
| CVE-2026-104040 | 4.4 MEDIUM | Sssd: sssd: information disclosure via odata injection in entra id lookups |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-104044
Sssd: sssd: denial of service via crafted passkey kerberos a -
CVE-2026-104043
Sssd: sssd: denial of service via undersized packet parsing -
CVE-2026-104042
Sssd: sssd: denial of service via out-of-bounds read in pam -
CVE-2026-104041
Sssd: sssd: denial of service via unbounded negative cache g -
CVE-2026-104040
Sssd: sssd: information disclosure via odata injection in en
Same vendor: Red Hat
-
CVE-2026-105305
Keycloak-services: keycloak-services: device authorization g -
CVE-2026-104044
Sssd: sssd: denial of service via crafted passkey kerberos a -
CVE-2026-104043
Sssd: sssd: denial of service via undersized packet parsing -
CVE-2026-104042
Sssd: sssd: denial of service via out-of-bounds read in pam -
CVE-2026-104041
Sssd: sssd: denial of service via unbounded negative cache g
Same weakness: CWE-193
-
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util -
CVE-2026-100889
Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decod -
CVE-2026-18460
Off-by-one Error, Out-of-bounds Write vulnerability in RTI C -
CVE-2026-83600
Netdata: Streaming protocol chart slot guard off-by-one allo -
CVE-2026-76081
ZITADEL: Improper Role Revocation on Granted Projects during
V. Comments for CVE-2026-104033
No comments yet