Is CVE-2026-104032 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104032 being exploited in the wild.

How severe is CVE-2026-104032?

Medium severity, with a CVSS score of 5.5, published 6 October 2026.

Is there a fix for CVE-2026-104032?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-104032 attacked?

It is attacked with local access.

Am I affected by CVE-2026-104032?

Check whether you run Red Hat SSSD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104032: SSSD authorization bypass in autofs responder DoS

CVE-2026-104032 · Severity: medium · CVSS 5.5 · Published 2026-10-06

SSSD is a system daemon that manages identity and authentication on Linux systems, including support for automount operations that automatically mount network filesystems. An unprivileged local user can repeatedly trigger cache invalidation through the autofs responder due to missing authorization checks, causing the system to repeatedly query backend directory services and degrading automount performance. This results in service unavailability and increased resource consumption, but does not compromise confidentiality or allow privilege escalation.

Technologies: Red Hat SSSD. Vendors: Red Hat.

Quick answers

Is CVE-2026-104032 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104032 being exploited in the wild.
How severe is CVE-2026-104032?: Medium severity, with a CVSS score of 5.5, published 6 October 2026.
Which products and versions are affected?: Red Hat SSSD.
Is there a fix for CVE-2026-104032?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104032 attacked?: It is attacked with local access.
Am I affected by CVE-2026-104032?: Check whether you run Red Hat SSSD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Missing authorization checks in the SSSD autofs responder allow an authenticated local attacker to repeatedly request master automount map updates, triggering global cache invalidation (CWE-408). Each request forces the system to perform lookups against backend directory providers, consuming CPU and memory resources. An attacker with local access to the responder socket can degrade automount lookup performance without user interaction.

Affected products

Red Hat SSSD

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.