{"id":"CVE-2026-104715","title":"Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass","summary":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input valu…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-88"],"vendor":"Red Hat","product":"cifs-utils","affected":["cifs-utils (all versions)","cifs-utils","cifs-utils (all versions)","cifs-utils (all versions)","cifs-utils (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"exploitAvailable":true,"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:08:57.714Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104715","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104715"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545023","label":"RHBZ#2545023"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104715.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104715"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104715"}],"tags":["cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00139,"epssPercentile":0.02907,"exploits":{"github":1,"githubRepos":["https://github.com/M3aCulpa/CVE-2026-104715"],"checkedAt":"2026-10-16T18:43:43.182Z"},"ingestedAt":"2026-10-16T07:01:11.475Z","slug":"CVE-2026-104715","body":"## Overview\n\nA flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.\n\n## Affected\n\n- `cifs-utils (all versions)`\n- `cifs-utils`\n- `cifs-utils (all versions)`\n- `cifs-utils (all versions)`\n- `cifs-utils (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104715.json)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}