CVE-2026-104033: SSSD Authentication Bypass Vulnerability

CVE-2026-104033 Overview

CVE-2026-104033 is an authentication bypass vulnerability in the System Security Services Daemon (SSSD). When SSSD enforces account expiration using Lightweight Directory Access Protocol (LDAP) shadow attributes, it fails to treat an expiration value of zero as an expired account. A user holding valid credentials for an account that administrators intended to deactivate can authenticate successfully. The flaw stems from an off-by-one condition tracked as [CWE-193]. This allows unauthorized access to persist after the account should have been disabled, undermining account lifecycle controls on affected Linux systems.

Critical Impact

Authenticated users can bypass LDAP-enforced account expiration and retain access after their accounts should be disabled, defeating deprovisioning policies.

Affected Products

• SSSD (System Security Services Daemon)
• Linux distributions integrating SSSD for LDAP-based authentication
• Red Hat Enterprise Linux deployments using SSSD with LDAP shadow attributes

Discovery Timeline

• 2026-10-06 - CVE CVE-2026-104033 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104033

Vulnerability Analysis

SSSD provides access to remote identity and authentication providers for Linux hosts. One supported mechanism is LDAP account expiration enforcement using shadow attributes, specifically shadowExpire. The shadowExpire attribute defines the number of days since the Unix epoch after which the account becomes invalid.

SSSD compares the current day count against the shadowExpire value to decide whether to permit authentication. The vulnerable implementation does not correctly handle the boundary value of zero. When shadowExpire is set to zero, SSSD does not classify the account as expired and continues to accept valid credentials.

The result is a bypass of the intended account deactivation policy. Administrators relying on this attribute to disable accounts leave a window in which authenticated users can continue to log in. The underlying weakness is an off-by-one error [CWE-193] in the expiration comparison logic.

Root Cause

The root cause is incorrect boundary handling in SSSD's shadow attribute evaluation. The expiration check treats a shadowExpire value of zero as a non-expiration marker rather than as an expired state. Attributes set to zero therefore fall through the enforcement path instead of denying authentication.

Attack Vector

Exploitation requires valid credentials for an account whose shadowExpire attribute has been set to zero to deactivate it. The attacker authenticates to any SSSD-backed service, such as SSH or local login, over the network. No elevated privileges or user interaction are required beyond possession of the credentials, and no additional exploit code is needed.

The vulnerability is described in prose because no verified proof-of-concept has been published. See the Red Hat CVE-2026-104033 advisory and Red Hat Bug Tracker ID #2479271 for additional technical references.

Detection Methods for CVE-2026-104033

Indicators of Compromise

• Successful SSSD authentication events for accounts whose LDAP shadowExpire attribute is set to zero.
• SSH or PAM session establishment for user accounts that administrators have marked as deactivated through LDAP shadow attributes.
• Discrepancies between LDAP account expiration state and observed login activity in /var/log/secure or journalctl authentication records.

Detection Strategies

• Correlate LDAP directory data with authentication logs to identify sessions created for accounts where shadowExpire equals zero.
• Audit SSSD debug logs with debug_level raised on affected hosts to confirm whether the expiration path denies or permits zero-valued accounts.
• Review PAM account phase decisions to spot cases where expected pam_sss denials are absent for deprovisioned users.

Monitoring Recommendations

• Alert on authentication activity from accounts flagged as expired in the identity management system.
• Track changes to the shadowExpire attribute across the LDAP directory and compare against subsequent login telemetry.
• Forward SSSD and PAM logs to a centralized data lake to enable longitudinal review of account expiration enforcement.

How to Mitigate CVE-2026-104033

Immediate Actions Required

• Inventory LDAP accounts where shadowExpire is set to zero and reset those entries to a non-zero past date to force expiration enforcement across all SSSD versions.
• Apply vendor-supplied SSSD updates on affected Linux hosts once available from the distribution.
• Review recent authentication logs for sessions established by accounts intended to be deactivated and revoke any active sessions.

Patch Information

Monitor the Red Hat CVE-2026-104033 advisory and Red Hat Bug Tracker ID #2479271 for fixed SSSD package versions. Install updates through the standard distribution package manager and restart the sssd service after upgrade. Confirm the fix by verifying that authentication is denied for a test account with shadowExpire set to zero.

Workarounds

• Avoid using a shadowExpire value of zero to deactivate accounts. Use a specific past epoch day count such as 1 instead.
• Disable or lock accounts at the directory level using additional controls, for example setting nsAccountLock or removing group memberships required for login.
• Enforce account deactivation at the service layer with PAM access.conf rules or SSH AllowUsers and DenyUsers directives until SSSD is patched.

# Configuration example: force expiration without relying on shadowExpire=0
# Set shadowExpire to a non-zero past day count (days since 1970-01-01)
ldapmodify -x -D "cn=admin,dc=example,dc=com" -W <<EOF
dn: uid=jdoe,ou=People,dc=example,dc=com
changetype: modify
replace: shadowExpire
shadowExpire: 1
EOF

# Supplement with PAM access control
echo "- : jdoe : ALL" >> /etc/security/access.conf