Vulnerability · Published Oct 16, 2026 · Assigned by redhat
CVE-2026-104715Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
High 7.8
In plain English
A high-severity argument injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | cifs-utils | 7.1-r1 | ALPINE-CVE-2026-104715 |
| Alpine:v3.22 | cifs-utils | 7.3-r1 | ALPINE-CVE-2026-104715 |
| Alpine:v3.23 | cifs-utils | 7.4-r1 | ALPINE-CVE-2026-104715 |
| Alpine:v3.24 | cifs-utils | 7.5-r1 | ALPINE-CVE-2026-104715 |
| Debian:12 | cifs-utils | no fix listed | DEBIAN-CVE-2026-104715 |
| Debian:13 | cifs-utils | 2:7.4-1+deb13u1 | DEBIAN-CVE-2026-104715 |
| Debian:14 | cifs-utils | 2:7.9-1 | DEBIAN-CVE-2026-104715 |
| Ubuntu:22.04:LTS | cifs-utils | 2:6.14-1ubuntu0.7 | USN-8938-1 |
| Ubuntu:22.04:LTS | cifs-utils | 2:6.14-1ubuntu0.7 | UBUNTU-CVE-2026-104715 |
| Ubuntu:24.04:LTS | cifs-utils | 2:7.0-2ubuntu0.6 | USN-8938-1 |
| Ubuntu:24.04:LTS | cifs-utils | 2:7.0-2ubuntu0.6 | UBUNTU-CVE-2026-104715 |
| Ubuntu:26.04:LTS | cifs-utils | 2:7.4-1ubuntu0.26.04.4 | UBUNTU-CVE-2026-104715 |
| Ubuntu:26.04:LTS | cifs-utils | 2:7.4-1ubuntu0.26.04.4 | USN-8938-1 |
| Ubuntu:26.10 | cifs-utils | 2:7.4-1ubuntu3.1 | USN-8938-1 |
| Ubuntu:26.10 | cifs-utils | 2:7.4-1ubuntu3.1 | UBUNTU-CVE-2026-104715 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-104715 vdb-entry, x_refsource_REDHAT
- RHBZ#2545023 issue-tracking, x_refsource_REDHAT
- http://www.openwall.com/lists/oss-security/2026/10/16/35