Executive brief
SSSD is a system service that authenticates users and manages access control for enterprise Linux systems. When misconfigured with specific LDAP access controls, it can incorrectly grant access to users that have been deleted or deprovisioned from the directory, allowing a former employee or contractor to maintain unauthorized access to systems and data. An attacker with a previously valid account can exploit this to access information and modify resources they should no longer have permissions for.
Technical details
A fail-open condition in SSSD's LDAP ppolicy access provider occurs when a user lookup returns zero results, causing the access check to incorrectly return success and cache an allow decision. This affects SSSD configured with access_provider = ldap and ldap_access_order including ppolicy or lockout, requiring pre-existing local SSSD user state. An authenticated remote attacker can maintain access for deleted or deprovisioned accounts.
Affected products
- Red Hat SSSD
Timeline
- 2026-09-22: disclosed
- other: Requires specific non-default LDAP access control configuration (access_provider=ldap with ldap_access_order including ppolicy or lockout)