This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-92821 →
UBUNTU-CVE-2026-92821
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Acce...
Original description
The description as published by the source.
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
sssd
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report bugzilla.redhat.com
- report access.redhat.com