Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-92821

CVE-2026-92821: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium6.8

    Medium [CVE-2026-92821] Sssd: sssd: access control bypass via premature ldap access rule evaluation

    CVE-2026-92821Source published Source updated

    A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems. This vulnerability is rated as Moderate severity because successful exploitation requires a specific non-default configuration where `pwd_expire_policy_warn` is ordered ahead of restrictive rules in `ldap_access_order`, combined with a valid user account possessing an…

    Affected products in this advisory
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 6
    • Red Hat Enterprise Linux 7
    • Red Hat Enterprise Linux 8

    33 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Workarounds
    • To mitigate this issue without applying package fixes, reconfigure SSSD access ordering so that password expiration warnings do not precede restrictive access rules. 1. Modify `/etc/sssd/sssd.conf` in the relevant domain section: - Place `pwd_expire_policy_warn` after restrictive rules in `ldap_access_order` (e.g., change `ldap_access_order = pwd_expire_policy_warn, filter, host` to `ldap_access_order = filter, host, pwd_expire_policy_warn`). - Alternatively, replace `pwd_expire_policy_warn` with `pwd_expire_policy_reject` if expired accounts must not proceed through subsequent checks. 2. Restart the SSSD service to apply the configuration: ``` systemctl restart sssd ``` Warning: Restarting SSSD causes a brief disruption to active authentication requests and identity lookups. Additionally, altering access rules or switching to `pwd_expire_policy_reject` may alter user access behavior by immediately denying accounts with expired credentials.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features