CLSA-2026-1792405584 sssd: Fix of 3 CVEs

CVE-2026-90462: deny access and cache the deny decision when the LDAP ppolicy access check lookup returns zero results, fixing a fail-open that let deleted or deprovisioned users keep passing access checks - CVE-2026-90996: reject header-only requests with an empty body in the NSS responder...

CLSA-2026-1791809045 sssd: Fix of 2 CVEs

CVE-2026-90462: deny access in sdapaccessppolicystepdone when the LDAP ppolicy user search returns zero entries, instead of returning success and caching an allow decision - CVE-2026-90996: reject an empty request body in the NSS responder request parsers before bodyblen - 1 is read...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791809045)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791809045 advisory. - A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a...

CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...