CVE-2026-90462: SSSD LDAP Authentication Bypass Vulnerability

CVE-2026-90462 Overview

CVE-2026-90462 is a broken access control flaw in the System Security Services Daemon (SSSD). The vulnerability affects deployments configured with the Lightweight Directory Access Protocol (LDAP) access provider when ldap_access_order includes ppolicy or lockout. A fail-open condition in the LDAP ppolicy access check returns success when a user lookup yields zero results. SSSD then caches an allow decision, permitting continued authorization for accounts that have been deleted or deprovisioned. The weakness is tracked as [CWE-280: Improper Handling of Insufficient Permissions or Privileges].

Critical Impact

A remote attacker with prior valid account context can retain access to information and make limited modifications to resources after account removal.

Affected Products

• SSSD (System Security Services Daemon)
• Linux distributions integrating SSSD with LDAP access provider
• Red Hat Enterprise Linux deployments using ldap_access_order = ppolicy or lockout

Discovery Timeline

• 2026-09-22 - CVE-2026-90462 published to the National Vulnerability Database
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-90462

Vulnerability Analysis

SSSD provides access to remote identity and authentication providers on Linux systems. When administrators configure the LDAP access provider with ldap_access_order set to include ppolicy or lockout, SSSD queries the directory to evaluate password policy state before authorizing a session. The affected code path treats an empty result set from the user lookup as a successful policy check. The daemon then caches that allow decision locally, meaning subsequent authorization requests for the same principal succeed without re-validating account existence.

Root Cause

The defect is a logic error in the ppolicy access check. The function does not distinguish between a policy evaluation that explicitly permits access and a lookup that returns zero entries. Both conditions produce a success return value. This violates the secure default of denying access when the authoritative source cannot confirm an active account.

Attack Vector

Exploitation requires an attacker who previously held valid credentials on a system where SSSD is caching authorization decisions. After the account is deleted or disabled in the directory, subsequent lookups return no entries. The cached allow decision continues to grant the attacker access to local resources tied to the SSSD-managed identity. The attacker can read protected information and perform modifications constrained by the account's prior permissions.

No verified proof-of-concept code is publicly available. See the Red Hat CVE-2026-90462 Advisory and Red Hat Bug #2479483 for authoritative technical details.

Detection Methods for CVE-2026-90462

Indicators of Compromise

• Successful SSSD authorization events for user principals that no longer exist in the backing LDAP directory
• sssd_be or sssd_pam log entries showing ppolicy checks returning success with zero LDAP result entries
• Access to resources or file shares by accounts recently removed or disabled in the identity provider

Detection Strategies

• Correlate LDAP directory account deletions with subsequent successful authentications on Linux hosts running SSSD
• Enable SSSD debug logging (debug_level = 6 or higher) on the LDAP domain and inspect ldap_access_check traces for empty result handling
• Compare cached SSSD credential entries against the current LDAP user base to identify stale allow decisions

Monitoring Recommendations

• Forward /var/log/sssd/*.log to a centralized logging pipeline for retention and analysis
• Alert on authorization decisions issued for principals absent from the current directory snapshot
• Track modifications to /etc/sssd/sssd.conf, particularly changes to ldap_access_order and access_provider directives

How to Mitigate CVE-2026-90462

Immediate Actions Required

• Apply vendor-provided SSSD updates as soon as they are released for your distribution
• Audit /etc/sssd/sssd.conf for the presence of ppolicy or lockout in ldap_access_order
• Invalidate SSSD caches on affected hosts using sss_cache -E after deprovisioning any account
• Review recently deleted directory accounts and confirm no residual sessions remain on SSSD-managed systems

Patch Information

Refer to the Red Hat CVE-2026-90462 Advisory for package versions containing the fix. Track distribution-specific errata for SSSD updates and apply them through your standard package manager. Restart the sssd service after upgrading to ensure the patched code path is loaded.

Workarounds

• Remove ppolicy and lockout from ldap_access_order and rely on alternative access control filters such as filter until patched packages are deployed
• Reduce SSSD credential cache lifetime by lowering entry_cache_timeout and cache_credentials values to shorten the window of stale allow decisions
• Enforce timely account deprovisioning at the directory level and pair removals with cache flushes on all consuming hosts

# Configuration example: /etc/sssd/sssd.conf
[domain/example.com]
access_provider = ldap
# Temporary workaround: avoid ppolicy/lockout in ldap_access_order
ldap_access_order = filter
ldap_access_filter = (objectClass=posixAccount)
entry_cache_timeout = 300
cache_credentials = false