# CVE-2026-104045: SSSD race condition denial of service in autofs responder

Source: https://junglewise.ai/threats/cve-2026-104045-a-flaw-was-found-in-sssd-a-local-user-can-trigger-a-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-104045 · Severity: medium · CVSS 4.7 · Published 2026-10-06

SSSD is a system service that manages user authentication and identity information on Linux systems, including automount map management. A local user can crash or disrupt the autofs service by repeatedly sending conflicting enumeration and invalidation requests, exploiting a race condition that leaks memory and eventually exhausts system resources.

Technologies: [Red Hat SSSD](https://junglewise.ai/threats/technologies/red-hat-sssd). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-104045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104045 being exploited in the wild.

**How severe is CVE-2026-104045?** Medium severity, with a CVSS score of 4.7, published 6 October 2026.

**Which products and versions are affected?** Red Hat SSSD.

**Is there a fix for CVE-2026-104045?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104045 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-104045?** Check whether you run Red Hat SSSD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in SSSD's autofs responder between asynchronous enumeration completion and map invalidation, allowing concurrent requests to leak memory via improper resource cleanup (CWE-772). An attacker with local access can trigger denial of service by sustaining concurrent map enumeration and invalidation requests, causing memory exhaustion that disrupts or crashes only the autofs responder daemon, not the broader system.

## Affected products

- Red Hat SSSD

## Timeline

- 2026-10-06: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-104045](https://access.redhat.com/security/cve/CVE-2026-104045)

## Related threats

- [SSSD PAM responder NULL pointer dereference in JSON extension](https://junglewise.ai/threats/cve-2026-127100-a-flaw-was-found-in-sssd-s-pam-responder-on-builds-with-the-json)
- [SSSD stack buffer overflow in X.509 RSA certificate conversion](https://junglewise.ai/threats/cve-2026-127099-a-flaw-was-found-in-sssd-s-conversion-of-x-509-certificate-rsa)
- [SSSD authorization bypass via username collision in HBAC](https://junglewise.ai/threats/cve-2026-104048-a-flaw-was-found-in-sssd-in-trust-enabled-identity-management)
- [SSSD query injection in Microsoft Entra ID lookups](https://junglewise.ai/threats/cve-2026-104047-a-flaw-was-found-in-sssd-when-configured-to-use-microsoft-entra)
- [SSSD integer underflow in NSS responder packet parsing](https://junglewise.ai/threats/cve-2026-104043-a-flaw-was-found-in-sssd-a-local-attacker-with-access-to-the)