Lenovo XClarity Controller (XCC) - LDAP/AD authorization: When XCC is configured to authenticate against Active

Impact

When XCC is configured to authenticate against Active Directory, a user's local XCC account permissions silently override the permissions their directory group grants - and the local ones can be higher. The result is privilege escalation that your identity provider cannot see: you revoke someone's admin rights in AD, XCC keeps honouring the stale local grant, and they retain out-of-band control of the node. For an operator this is a offboarding and least-privilege failure more than an exploit, which makes it easy to miss - nothing looks broken, and the directory tells you the access is gone.

Who can reach it

A valid XCC user in a deployment where LDAP/AD is configured for authentication and authorisation and the user also has a local XCC account. No exploit code required - the misbehaviour is in the authorisation logic itself.

What to do

Flash XCC to the version listed for your model in LEN-118321 - out-of-band, per-node, no host reboot and no drain. Alongside the flash, do the config work that actually closes the gap: enumerate local XCC accounts on every node and delete the ones that shadow directory identities, because patching the precedence logic does not remove local accounts that are already there.

References