# CVE-2026-104032: SSSD authorization bypass in autofs responder DoS

Source: https://junglewise.ai/threats/cve-2026-104032-a-flaw-was-found-in-sssd-an-unprivileged-local-user-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-104032 · Severity: medium · CVSS 5.5 · Published 2026-10-06

SSSD is a system daemon that manages identity and authentication on Linux systems, including support for automount operations that automatically mount network filesystems. An unprivileged local user can repeatedly trigger cache invalidation through the autofs responder due to missing authorization checks, causing the system to repeatedly query backend directory services and degrading automount performance. This results in service unavailability and increased resource consumption, but does not compromise confidentiality or allow privilege escalation.

Technologies: [Red Hat SSSD](https://junglewise.ai/threats/technologies/red-hat-sssd). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-104032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104032 being exploited in the wild.

**How severe is CVE-2026-104032?** Medium severity, with a CVSS score of 5.5, published 6 October 2026.

**Which products and versions are affected?** Red Hat SSSD.

**Is there a fix for CVE-2026-104032?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104032 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-104032?** Check whether you run Red Hat SSSD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Missing authorization checks in the SSSD autofs responder allow an authenticated local attacker to repeatedly request master automount map updates, triggering global cache invalidation (CWE-408). Each request forces the system to perform lookups against backend directory providers, consuming CPU and memory resources. An attacker with local access to the responder socket can degrade automount lookup performance without user interaction.

## Affected products

- Red Hat SSSD

## Timeline

- 2026-10-06: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-104032](https://access.redhat.com/security/cve/CVE-2026-104032)

## Related threats

- [SSSD PAM responder NULL pointer dereference in JSON extension](https://junglewise.ai/threats/cve-2026-127100-a-flaw-was-found-in-sssd-s-pam-responder-on-builds-with-the-json)
- [SSSD stack buffer overflow in X.509 RSA certificate conversion](https://junglewise.ai/threats/cve-2026-127099-a-flaw-was-found-in-sssd-s-conversion-of-x-509-certificate-rsa)
- [SSSD race condition denial of service in autofs responder](https://junglewise.ai/threats/cve-2026-104045-a-flaw-was-found-in-sssd-a-local-user-can-trigger-a-denial-of)
- [SSSD authorization bypass via username collision in HBAC](https://junglewise.ai/threats/cve-2026-104048-a-flaw-was-found-in-sssd-in-trust-enabled-identity-management)
- [SSSD query injection in Microsoft Entra ID lookups](https://junglewise.ai/threats/cve-2026-104047-a-flaw-was-found-in-sssd-when-configured-to-use-microsoft-entra)