{"id":"CVE-2026-104715","aliases":["ALPINE-CVE-2026-104715","AZL-109782","CLSA-2026-1792790974","DEBIAN-CVE-2026-104715","EUVD-2026-102803","GHSA-pvh7-9hhh-pfhr","MGASA-2026-0556","SUSE-SU-2026:24372-1","SUSE-SU-2026:24435-1","SUSE-SU-2026:24462-1","SUSE-SU-2026:4819-1","SUSE-SU-2026:4897-1","UBUNTU-CVE-2026-104715","USN-8938-1","openSUSE-SU-2026:22170-1"],"status":"published","title":"Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00265,"percentile":0.18549,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-88"],"published":"2026-10-16T00:00:00Z","modified":"2026-11-04T17:23:17Z","exploits":[{"source":"pocgithub","id":"M3aCulpa/CVE-2026-104715","title":"M3aCulpa/CVE-2026-104715","date":"2026-10-15","url":"https://github.com/M3aCulpa/CVE-2026-104715"}],"fixes":[{"ecosystem":"Alpine:v3.21","package":"cifs-utils","fixed_in":["7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cifs-utils","fixed_in":["7.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cifs-utils","fixed_in":["7.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cifs-utils","fixed_in":["7.5-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cifs-utils","fixed_in":["7.9-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"cifs-utils","fixed_in":["2:6.8-2+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cifs-utils","fixed_in":["2:7.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cifs-utils","fixed_in":["2:7.9-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"cifs-utils","fixed_in":["7.5-1.2.mga10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"cifs-utils","fixed_in":["7.0-159998.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"cifs-utils","fixed_in":["7.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cifs-utils","fixed_in":["7.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cifs-utils","fixed_in":["7.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cifs-utils","fixed_in":["6.15-150400.3.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cifs-utils","fixed_in":["6.9-13.32.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cifs-utils","fixed_in":["6.9-13.32.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cifs-utils","fixed_in":["2:6.14-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"cifs-utils","fixed_in":["2:7.0-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"cifs-utils","fixed_in":["2:7.4-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"cifs-utils","fixed_in":["2:7.4-1ubuntu0.26.04.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cifs-utils","fixed_in":["7.4-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.9-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.8-2+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.0-2","2:7.0-2.1","2:7.1-1","2:7.2-1","2:7.2-2","2:7.3-1","2:7.4-1","2:7.8-1","2:7.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4-1+deb13u1"}]}],"versions":["2:7.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.9-1"}]}],"versions":["2:7.4-1","2:7.8-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5-1.2.mga10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0-159998.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.15-150400.3.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-13.32.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-13.32.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0-1ubuntu2","2:6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.4-1ubuntu1","2:6.4-1ubuntu1.1","2:6.4-1ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.7-1","2:6.8-1","2:6.8-1ubuntu1","2:6.8-1ubuntu1.1","2:6.8-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.9-0ubuntu1","2:6.9-1","2:6.9-1ubuntu0.1","2:6.9-1ubuntu0.2","2:6.9-1ubuntu0.3","2:6.9-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.14-1ubuntu0.7"}]}],"versions":["2:6.11-3.1","2:6.14-1","2:6.14-1build1","2:6.14-1ubuntu0.1","2:6.14-1ubuntu0.2","2:6.14-1ubuntu0.3","2:6.14-1ubuntu0.4","2:6.14-1ubuntu0.5","2:6.14-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.0-2ubuntu0.6"}]}],"versions":["2:7.0-2","2:7.0-2build1","2:7.0-2ubuntu0.1","2:7.0-2ubuntu0.2","2:7.0-2ubuntu0.3","2:7.0-2ubuntu0.4","2:7.0-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4-1ubuntu3.1"}]}],"versions":["2:7.4-1build1","2:7.4-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4-1ubuntu0.26.04.4"}]}],"versions":["2:7.4-1","2:7.4-1build1","2:7.4-1ubuntu0.26.04.1","2:7.4-1ubuntu0.26.04.2","2:7.4-1ubuntu0.26.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.14-1ubuntu0.7"}]}],"versions":["2:6.11-3.1","2:6.14-1","2:6.14-1build1","2:6.14-1ubuntu0.1","2:6.14-1ubuntu0.2","2:6.14-1ubuntu0.3","2:6.14-1ubuntu0.4","2:6.14-1ubuntu0.5","2:6.14-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.0-2ubuntu0.6"}]}],"versions":["2:7.0-2","2:7.0-2build1","2:7.0-2ubuntu0.1","2:7.0-2ubuntu0.2","2:7.0-2ubuntu0.3","2:7.0-2ubuntu0.4","2:7.0-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4-1ubuntu3.1"}]}],"versions":["2:7.4-1build1","2:7.4-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4-1ubuntu0.26.04.4"}]}],"versions":["2:7.4-1","2:7.4-1build1","2:7.4-1ubuntu0.26.04.1","2:7.4-1ubuntu0.26.04.2","2:7.4-1ubuntu0.26.04.3"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-160000.3.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104715","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545023","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/16/35"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104715","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pvh7-9hhh-pfhr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-104715","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792790974.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104715","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0556.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36524","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00481.html","tags":["web"]},{"url":"https://lists.samba.org/archive/samba-technical/2026-October/141162.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/16/35","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WB362TX7CVA2OXAQXUQYSDPX6JRPMLNG/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/735Q2KM2SJQ6FNHEIYWBCAXNGNH37HGU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8938-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624372-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-104715","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624435-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624462-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264819-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264897-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104715","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104715","title":"Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T06:47:10.481Z","modified":"2026-11-04T21:41:06.386Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2026-102803","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T06:47:10Z","modified":"2026-11-04T21:41:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-pvh7-9hhh-pfhr","title":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege...","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T09:30:25Z","modified":"2026-10-16T21:32:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:13:52.91817Z"}],"nvd":[{"id":"CVE-2026-104715","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T07:17:08.09Z","modified":"2026-11-04T22:17:45.113Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-04T23:43:40.883865Z"}],"osv":[{"id":"ALPINE-CVE-2026-104715","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T07:17:08.09Z","modified":"2026-10-23T18:30:02.502701041Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"DEBIAN-CVE-2026-104715","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T07:17:08.09Z","modified":"2026-11-05T09:47:30.885579882Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-104715","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-28T20:16:18.464269316Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-109782","title":"CVE-2026-104715 affecting package cifs-utils for versions less than 7.9-1","description":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.","status":"published","published":"2026-10-16T07:17:08Z","modified":"2026-11-02T14:17:30.818130616Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"CLSA-2026-1792790974","title":"Fix CVE(s): CVE-2026-104715","description":"   * SECURITY UPDATE: mount option injection via credentials file values\n     - debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject\n       username= and domain= values from a credentials file, and the USER\n       environment variable or passwd login name, that contain an option\n       delimiter (comma, equals, CR or LF) before they are assembled into\n       the kernel mount option string.\n     - CVE-2026-104715","status":"published","published":"2026-10-23T21:29:45Z","modified":"2026-10-26T09:31:53.127539561Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0556","title":"Updated cifs-utils package fixes a security vulnerability","description":"cifs-utils 4.2-7.8 mount-option injection in mount.cifs.\n(CVE-2026-104715)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:15:03.657822877Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:22170-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-26T13:02:12Z","modified":"2026-11-01T17:23:28.413892472Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24372-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-23T08:00:56Z","modified":"2026-10-27T17:23:17.355104874Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24435-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-26T13:04:49Z","modified":"2026-10-30T17:23:18.904192337Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24462-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-26T13:04:49Z","modified":"2026-11-04T17:23:17.635931267Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:4819-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-21T10:16:27Z","modified":"2026-10-21T20:02:14.691930812Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4897-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issue:\n\n- CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).\n","status":"published","published":"2026-10-23T10:51:23Z","modified":"2026-10-24T17:23:09.358482652Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8938-1","title":"cifs-utils vulnerability","description":"It was discovered that cifs-utils incorrectly handled credentials files\nused by privileged mount.cifs invocations. A local attacker could\npossibly use this issue to inject arbitrary mount options into a\nprivileged mount, resulting in a privilege escalation.","status":"published","published":"2026-10-19T13:56:50Z","modified":"2026-10-19T23:43:22.495844909Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}