SSSD CVE-2026-104032

Requires an interactive or otherwise authenticated unprivileged local account on a host running SSSD with the autofs responder enabled and automount maps served through SSSD (a backend directory provider such as LDAP/AD must be configured for map lookups). The root cause is a missing authorization check in the autofs responder's handling of master automount map update requests. Exploitation is limited to local access only (no network vector), affects availability only, and depends on autofs/SSSD integration being actively in use - hosts not using SSSD-backed automount are not exposed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: an authenticated but unprivileged local user can trigger availability-only impact with low complexity and no user interaction. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no evidence of active or at-scale exploitation - the signals that would elevate priority are all absent or unknown. The impact is confined to availability (automount service degradation and backend/CPU/IO resource consumption); there is no confidentiality or integrity loss, which is why CWE-408 (incorrect behavior order / resource amplification) rather than a code-execution weakness applies. Because exploitation requires an existing local account, the realistic threat is a malicious or compromised low-privilege user on a multi-user host, or lateral post-compromise abuse, rather than remote mass exploitation. No signals conflict in this case; the main limitation is simply the volume of intelligence, as only Red Hat source data is available.

A logged-in unprivileged user on a RHEL host running SSSD with autofs integration scripts repeated master automount map update requests to the autofs responder. Because the responder performs no authorization check, each request forces global cache invalidation and fresh lookups against the backend directory provider (e.g., LDAP/AD), degrading automount availability and driving up resource usage for all users on the system. No public exploit identified at time of analysis, so an attacker would craft the request loop manually.