CVE-2026-104715
Received Received - Intake

Privilege Escalation in cifs-utils via Mount Options Injection

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-104715
EUVD
EUVD-2026-102803

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in cifs-utils, specifically the mount.cifs utility. It allows a local unprivileged user to escalate privileges by injecting malicious mount options through a user-controlled credentials file. The flaw occurs because the username field in the credentials file is not properly validated, enabling attackers to set options like uid=0 or forceuid. This can make files appear owned by root with SUID capabilities, allowing execution with root privileges.

Detection Guidance

Check if cifs-utils is installed and its version with: rpm -q cifs-utils or dpkg -l cifs-utils. Inspect mount.cifs usage in systemd services or pam_mount configurations for user-controlled credential files. Look for suspicious mount options like uid=0, forceuid, or file_mode=04755 in /etc/fstab or mount logs.

Impact Analysis

An attacker could exploit this to gain root access on your system. If a privileged service mounts a CIFS share using your credentials file, you could craft the username to inject options like noperm or file_mode=04755. This might let you create SUID-root binaries or modify files with elevated permissions, bypassing normal security controls.

Compliance Impact

This vulnerability could lead to unauthorized privilege escalation, potentially violating access control requirements in GDPR and HIPAA. If exploited, it may allow attackers to access or modify sensitive data without proper authorization, compromising confidentiality and integrity controls mandated by these regulations.

Mitigation Strategies

Update cifs-utils to the latest patched version immediately. Avoid using user-controlled credential files for privileged mounts. If unavoidable, restrict file permissions to root-only and validate mount options rigorously. Disable nosuid if present in mount options to prevent SUID bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart