SSSD CVE-2026-104033

Exploitation requires SSSD to be configured to enforce account expiration using LDAP shadow attributes (e.g., shadowExpire), and the expiration value for the target account must be stored as zero rather than a conventional date - this specific, non-default configuration is the core precondition. The attacker must also hold valid credentials (username and password) for the already-expired target account; this is a privileged/authenticated flaw (CVSS PR:L), not anonymous access. Deployments that enforce expiration through other providers (e.g., native LDAP non-shadow controls, Kerberos/FreeIPA policy, or local files) or that do not use the zero-value pattern are not affected, which meaningfully limits real-world exposure.

This is a moderate-severity logic flaw (CWE-193, boundary/off-by-one style error) in SSSD's handling of LDAP shadow account-expiration attributes, where an expiration value of zero is not interpreted as expired. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) indicates a network-reachable attack of low complexity that nonetheless requires low privileges - specifically, the attacker must already possess valid credentials for a specific account, which the description confirms. This is not a mass-exploitable unauthenticated RCE; it is an access-control-persistence bug whose impact is that a deliberately deactivated account remains usable. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or probable widespread exploitation - consistent with a flaw that benefits an insider or someone holding stale-but-valid credentials rather than an external mass attacker. No SSVC decision data was supplied. Overall this is a real but lower-tier hygiene/priority issue: patch in normal cycles, prioritize where SSSD enforces LDAP shadow-based expiration for sensitive or offboarded accounts. The one notable nuance: CVSS lists AV:N, but exploitation value is constrained by the attacker needing legitimate credentials for the targeted expired account - the network vector reflects the authentication path, not anonymous remote access.

An employee is offboarded and their account is set to expire via an LDAP shadow attribute, but the expiration is stored as zero. Because SSSD does not treat zero as expired, the former employee (or anyone still holding that account's valid credentials) authenticates normally over the network to an SSSD-backed RHEL system and retains access that was supposed to be revoked. No public exploit code was identified; exploitation requires only the valid credentials of the affected expired account.