A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory… (CVE-2026-92821)

CVE-2026-92821 is a vulnerability in SSSD where, if configured to evaluate password expiration warnings before restrictive access rules in LDAP environments, an expired-password warning causes early termination of rule evaluation and incorrectly grants access. A remote authenticated user with an expired password can exploit this by using an alternative authentication method such as SSH public key authentication to bypass access control restrictions and gain unauthorized access to protected systems. The vulnerability affects numerous specific versions of SSSD as listed, and has a CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

An attacker who is authenticated but has an expired password can bypass LDAP access control restrictions by exploiting the flaw in SSSD's evaluation order of password expiration warnings and restrictive access rules. This can lead to unauthorized access to protected systems, potentially resulting in confidentiality and integrity impacts. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review SSSD configuration related to password expiration and LDAP access rule evaluation order to mitigate the risk. Avoid configurations that evaluate password expiration warnings before restrictive access rules. Monitor vendor advisories for official patches or updates.