{"id":"CVE-2026-104032","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-104032","generatedAt":"2026-10-28T02:58:20.421Z","title":"An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks.","description":"A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.","published":"2026-10-06T01:16:34.000Z","lastModified":"2026-10-06T15:09:20.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-408"],"affected":[],"epss":{"score":0.00095,"percentile":0.00641,"date":"2026-10-26","history":[{"date":"2026-10-06","score":0.00095,"percentile":0.00625}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-06T01:16:34.000Z","detail":{"score":"5.5","severity":"MEDIUM","publishedAt":"2026-10-06T01:16:33.997Z"},"summary":"New CVE, medium severity (CVSS 5.5)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104032","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479381","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-104032","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}