SSSD autofs responder: missing authorization lets any local user force repeated automount cache invalidation

CVSS 5.5CVE-2026-104032Kernel, userspace & hypervisorcurated

Impact

The autofs responder does not check authorization on master automount map update requests, so an unprivileged local user can ask for them repeatedly. Each request invalidates the global cache and forces fresh lookups against the backend directory provider. The result is degraded or unavailable automount on the node plus amplified load on shared LDAP or Active Directory infrastructure - so the damage is not confined to the node the attacker sits on, which matters on a cluster where hundreds of nodes share one identity backend. This is an authorization gap, not a memory-safety bug: availability impact only, no disclosure or code execution.

Who can reach it

Any local unprivileged user on the node that can reach the SSSD autofs responder socket. No privileges beyond a local account.

What to do

Install the fixed sssd packages and restart sssd; the record does not name a fixed version, so take it from the Red Hat advisory. Daemon restart only, no node reboot or GPU drain. Where SSSD-sourced automount maps are not needed, disabling the autofs responder removes the request path; rate limiting on the identity backend reduces the amplification but does not fix the node-local effect.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-104032 https://access.redhat.com/security/cve/CVE-2026-104032 https://bugzilla.redhat.com/show_bug.cgi?id=2479381

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.