# CVE-2026-104033: SSSD LDAP shadow expiration bypass

Source: https://junglewise.ai/threats/cve-2026-104033-a-flaw-was-found-in-sssd-when-configured-to-enforce-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-104033 · Severity: medium · CVSS 5.4 · Published 2026-10-06

SSSD is a system service that manages user authentication and access control for Linux systems, particularly when using LDAP for centralized directory services. A flaw in SSSD fails to properly recognize when an LDAP account has expired, allowing users with valid passwords to authenticate to systems even after their accounts should have been deactivated. This could allow former employees or disabled accounts to maintain unauthorized access to systems.

Technologies: [SSSD Project SSSD](https://junglewise.ai/threats/technologies/sssd). Vendors: [SSSD Project](https://junglewise.ai/threats/vendors/sssd-project).

## Quick answers

**Is CVE-2026-104033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104033 being exploited in the wild.

**How severe is CVE-2026-104033?** Medium severity, with a CVSS score of 5.4, published 6 October 2026.

**Which products and versions are affected?** SSSD Project SSSD.

**Is there a fix for CVE-2026-104033?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104033 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-104033?** Check whether you run SSSD Project SSSD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SSSD contains an off-by-one error (CWE-193) in its LDAP shadow attribute expiration check that fails to treat a zero expiration value as an expired account. An attacker with valid credentials for an expired LDAP account can exploit this to bypass access controls and authenticate to the system. The vulnerability requires pre-existing valid credentials, a network connection, and SSSD configured with LDAP shadow-based expiration enforcement; it does not enable privilege escalation or remote code execution.

## Affected products

- SSSD Project SSSD

## Timeline

- 2026-10-06: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-104033](https://access.redhat.com/security/cve/CVE-2026-104033)

## Related threats

- [SSSD PAM responder NULL pointer dereference](https://junglewise.ai/threats/cve-2026-127101-a-flaw-was-found-in-sssd-s-pam-responder-a-local-attacker-can)
- [sssd responder denial of service via file descriptor exhaustion](https://junglewise.ai/threats/cve-2026-88252-a-flaw-was-found-in-sssd-a-local-user-can-cause-a-denial-of)
- [SSSD NFS idmap plugin out-of-bounds write](https://junglewise.ai/threats/cve-2026-104036-a-flaw-was-found-in-sssd-s-nfs-idmap-plugin-when-retrieving)
- [SSSD Kerberos Credential Manager memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-104035-a-flaw-was-found-in-sssd-an-issue-in-the-kerberos-credential)
- [SSSD memory leak in autofs responder](https://junglewise.ai/threats/cve-2026-104031-a-flaw-was-found-in-sssd-in-configurations-where-the-autofs)