Account Expiration Oversight in SSSD by Red Hat
CVE-2026-104033

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
6 October 2026

What is CVE-2026-104033?

A critical flaw exists in SSSD related to its handling of account expirations defined through LDAP shadow attributes. Specifically, SSSD does not process an expiration value of zero as intended for account deactivation. This oversight allows users who possess valid credentials for accounts that are supposed to be expired to authenticate, thereby circumventing access controls. As a result, unauthorized access to the system may persist even after accounts are deemed inactive.

References

https://access.redhat.com/security/cve/CVE-2026-104033
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479271
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Found by AISLE in partnership with Red Hat.
.