{"id":"CVE-2026-105494","kind":"vulnerability","aliases":["CVE-2026-105494"],"related":[],"title":"Azure NFS mount helper aznfs: untrusted search path lets local users gain privileges","description":"Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.","summary":"The Azure NFS mount helper (aznfs) resolves a program through an untrusted search path. An authorized local user can use this to run code with elevated privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"aznfs","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aznfs","azure","infrastructure","linux","nfs"],"not_affected_if":["no-aznfs-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:42:41+00:00","updated_at":"2026-11-10T19:42:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Azure NFS mount helper aznfs: untrusted search path lets local users gain privileges","impact":"high","summary":"The Azure NFS mount helper (aznfs) resolves a program through an untrusted search path. An authorized local user can use this to run code with elevated privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["azure","linux","nfs","aznfs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the host","analyst_note":"Find affected and fixed aznfs versions and the vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105494.","how_to_check":"- unknown","plain_action":"","product_name":"aznfs","needs_analyst":true,"not_affected_if":["no-aznfs-installed"],"who_is_affected":"Systems that mount Azure NFS file shares using the aznfs helper are the ones to look at. Machines that do not use aznfs, and shared hosts with no local untrusted users, are less exposed. The sources do not give affected versions or exact conditions.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4500,"output_tokens":478,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find affected and fixed aznfs versions and the vendor advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105494.","search":"'-105494':16A,19A '-2026':15A,18A 'allow':62C 'attack':65C 'author':41B,64C 'aznf':5A,21B,31B,61C 'aznfs':20A 'azur':1A,22B,27B,57C 'code':49B 'cve':14A,17A 'elev':51B,67C 'gain':12A 'helper':4A,30B,60C 'infrastructur':23B 'let':9A 'linux':24B 'local':10A,42B,69C 'mount':3A,29B,59C 'nfs':2A,25B,28B,58C 'path':8A,39B,55C 'privileg':13A,52B,68C 'program':34B 'resolv':32B 'run':48B 'search':7A,38B,54C 'untrust':6A,37B,53C 'use':45B 'user':11A,43B","nicknames":[],"mitigations":[],"who_affected":"Systems that mount Azure NFS file shares using the aznfs helper are the ones to look at. Machines that do not use aznfs, and shared hosts with no local untrusted users, are less exposed. The sources do not give affected versions or exact conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aznfs"],"ptokens":["aznfs"],"labels":["aznfs","azure","high","infrastructure","linux","nfs","vendor"],"campaign_type":null,"search_a":"'-105494':16A,19A '-2026':15A,18A 'aznf':5A 'aznfs':20A 'azur':1A 'cve':14A,17A 'gain':12A 'helper':4A 'let':9A 'local':10A 'mount':3A 'nfs':2A 'path':8A 'privileg':13A 'search':7A 'untrust':6A 'user':11A","search_b":"'author':41B 'aznf':21B,31B 'azur':22B,27B 'code':49B 'elev':51B 'helper':30B 'infrastructur':23B 'linux':24B 'local':42B 'mount':29B 'nfs':25B,28B 'path':39B 'privileg':52B 'program':34B 'resolv':32B 'run':48B 'search':38B 'untrust':37B 'use':45B 'user':43B","search_c":"'allow':62C 'attack':65C 'author':64C 'aznf':61C 'azur':57C 'elev':67C 'helper':60C 'local':69C 'mount':59C 'nfs':58C 'path':55C 'privileg':68C 'search':54C 'untrust':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105494","severity":null,"published_at":"2026-11-10T19:17:47+00:00","modified_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}