VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Sep 22, 2026· Updated Oct 7, 2026

CVE-2026-90462

CVE-2026-90462

Description

A flaw was found in SSSD. When configured with the LDAP access provider and ldap_access_order including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Fedoraproject/Sssd
    cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform
    cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server4 versions
    cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
  • SSSD/Sssdllm-fuzzy

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.