CVE-2026-90462
mediumA flaw was found in SSSD.
Vendor / product: Fedoraproject — sssd
A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.
CVSS
5.4
5.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2026-09-22 16:18
Modified: 2026-10-07 13:41
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:55 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fedoraproject / sssd 2.12.0
redhat / openshift_container_platform 4.0
redhat / enterprise_linux 7.0, 8.0, 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-90462
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2479483
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2479483
References
- https://access.redhat.com/security/cve/CVE-2026-90462 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2479483 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2479483 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗