{"id":"CVE-2026-104715","kind":"vulnerability","aliases":["CVE-2026-104715"],"related":[],"title":"cifs-utils: local user escalates to root through injected mount options","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","summary":"cifs-utils mishandles input from a user-controlled credentials file when a privileged service mounts a CIFS share. A local user can inject unauthorized mount options, bypass permission checks and run files with root privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cifs-utils","fixed":["7.9"],"affected":">= 4.2, <= 7.8","ecosystem":"linux"}],"ecosystems":[],"tags":["cifs","cifs-utils","infrastructure","linux","local-privilege-escalation","pam_mount","self-hosted","smb"],"not_affected_if":["credentials-file-not-user-writable","default-config","no-cifs-mounts"],"how_to_check":"- Run mount.cifs -V (or your package manager's cifs-utils version). Versions 4.2 to 7.8 are affected unless your distro has backported the fix; check the package changelog for CVE-2026-104715.\n- Look for privileged mounts that read a credentials= file from a user-writable location (pam_mount, automount, systemd units, fstab with user-owned files): grep -r credentials /etc/fstab /etc/security/pam_mount.conf.xml","fix":"Upgrade to cifs-utils 7.9 or a distro backport: Ubuntu 26.10 2:7.4-1ubuntu3.1, 26.04 2:7.4-1ubuntu0.26.04.4, 24.04 2:7.0-2ubuntu0.6, 22.04 2:6.14-1ubuntu0.7; Debian trixie 2:7.4-1+deb13u2 (bookworm still vulnerable at last check), sid 2:7.9-1; Fedora 43 7.7-2; SUSE SU-2026:4819-1. Until patched, make credentials files root-owned and not user-writable.","status":"open","published_at":"2026-10-16T07:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:10:20+00:00","updated_at":"2026-10-25T03:49:04+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:10:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"cifs-utils: local user escalates to root through injected mount options","impact":"high","summary":"cifs-utils mishandles input from a user-controlled credentials file when a privileged service mounts a CIFS share. A local user can inject unauthorized mount options, bypass permission checks and run files with root privileges.","category":"infrastructure","nicknames":[],"who_cares":["linux","cifs","smb","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root by injecting mount options","analyst_note":"Confirm the fixed cifs-utils version and the exact mount-option sanitization flaw from upstream advisories or the NVD entry.","how_to_check":"- `mount.cifs -V` to see the installed cifs-utils version\n- Check whether a privileged service mounts CIFS shares with a credentials file that unprivileged users can write to","needs_analyst":true,"not_affected_if":["no-cifs-mounts","credentials-file-not-user-writable"],"who_is_affected":"Systems where a privileged service mounts CIFS/SMB shares using a credentials file that a local unprivileged user can control. Hosts without cifs-utils or without such privileged mounts are unlikely to be exposed. The sources do not name fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000579,"input_tokens":3341,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed cifs-utils version and the exact mount-option sanitization flaw from upstream advisories or the NVD entry.","search":"'-104715':15A,18A '-2026':14A,17A 'achiev':91C 'administr':147C 'allow':85C,137C 'assembl':121C 'attack':127C 'bypass':66B,140C 'check':68B,142C 'cif':2A,22B,24B,39B,56B,81C,104C 'cifs':20A 'cifs-util':1A,23B,38B,80C 'cifs-utils':19A 'common':100C 'control':47B,110C 'credenti':48B,111C 'cve':13A,16A 'escal':6A,31B,93C 'execut':144C 'exploit':129C 'file':49B,71B,102C,112C,145C 'flaw':76C,84C 'found':78C 'host':36B 'infrastructur':26B 'inject':10A,62B,133C 'input':42B,113C 'internet':101C 'linux':27B 'local':4A,29B,59B,88C,126C 'local-privilege-escal':28B 'mishandl':41B 'mount':11A,33B,54B,64B,98C,123C,135C 'option':12A,65B,124C,136C 'pam':32B 'permiss':67B,141C 'privileg':30B,52B,74B,92C,96C,149C 'proper':117C 'root':8A,73B,148C 'run':70B 'sanit':118C 'self':35B 'self-host':34B 'servic':53B,97C 'share':57B,105C 'smb':37B 'system':103C 'unauthor':63B,134C 'unprivileg':87C 'use':106C 'user':5A,46B,60B,89C,109C 'user-control':45B,108C 'util':3A,25B,40B,82C 'utils':21A 'valu':114C 'vulner':131C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts with cifs-utils 4.2-7.8 where a privileged service (pam_mount, automation, scripts run as root) mounts a CIFS/SMB share using a credentials file a local unprivileged user can write. Red Hat says default RHEL installs do not do this, so exposure is limited to non-standard setups. Hosts without CIFS mounts, or with root-owned credentials files, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:49:04Z","by":"analyst","run_id":799},"products":{"at":"2026-10-25T03:49:04Z","by":"analyst","run_id":799}},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104715","severity":null,"published_at":"2026-10-16T07:17:08+00:00","modified_at":"2026-10-21T03:17:17+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104715:799","url":null,"severity":null,"published_at":"2026-10-25T03:49:04+00:00","modified_at":"2026-10-25T03:49:04+00:00","first_seen_at":"2026-10-25T03:49:04+00:00","fetched_at":"2026-10-25T03:49:04+00:00","note":"Upstream oss-security post (cifs-utils maintainers): affected 4.2-7.8, fixed in 7.9; distros backport (Ubuntu, Debian, SUSE, Fedora 7.7-2). Red Hat: Important, only non-default setups (e.g. pam_mount with credentials file in user-writable dir). Patches reject option delimiters in username/domain (Ubuntu changelog). No exploitation or PoC found; did not search social."}],"documents":[{"id":3357,"url":"http://www.openwall.com/lists/oss-security/2026/10/16/35","title":"oss-security: CVE-2026-104715 cifs-utils 4.2-7.8 mount-option injection (upstream, fixed in 7.9)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3359,"url":"https://access.redhat.com/security/cve/cve-2026-104715","title":"Red Hat CVE-2026-104715","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3360,"url":"https://ubuntu.com/security/CVE-2026-104715","title":"Ubuntu CVE-2026-104715","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3361,"url":"https://security-tracker.debian.org/tracker/CVE-2026-104715","title":"Debian tracker CVE-2026-104715","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}