CVE-2026-104032
Description
A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.
Statement
Red Hat rates this vulnerability as Moderate severity because it is restricted to local denial of service without compromising system confidentiality or integrity. The issue only presents a risk on systems configured with the SSSD automount responder where untrusted local users have access to the responder socket. Under these conditions, an authenticated local attacker can degrade automount lookup performance and increase load on backend directory services by triggering frequent cache purges, but cannot gain elevated privileges.
Mitigation
If SSSD automount integration is not required, disable the SSSD autofs responder so that unprivileged local users cannot issue autofs requests against it:
systemctl --now mask sssd-autofs.socket sssd-autofs.service
If the autofs responder is enabled through the `services` line in the `[sssd]` section of /etc/sssd/sssd.conf, remove `autofs` from that line and restart SSSD with `systemctl restart sssd`.
Caveats: disabling the autofs responder means SSSD will no longer serve automount maps to the automount daemon, and restarting SSSD briefly interrupts active identity lookups and automount operations. Where disabling the responder is not possible, restricting access to the autofs responder socket (for example via socket permissions or limiting which local UIDs may connect) so that only the intended trusted clients can reach it also reduces exposure before a fix is available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Acknowledgements
This issue was discovered by Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
