Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
CVE-2026-104117
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104117
illumos-gate
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
OmniOS
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/illumos/illumos-gate",
"vendor": "illumos",
"product": "illumos-gate",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8",
"status": "unaffected"
}
],
"version": "a73be61a80f7331c35adfa540bcf8f1546ff1e33",
"lessThan": "e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8",
"versionType": "git"
}
],
"platforms": [
"x86"
],
"packageName": "SUNWcs",
"programFiles": [
"usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c"
],
"collectionURL": "https://illumos.org",
"defaultStatus": "unaffected"
},
{
"vendor": "OmniOS",
"product": "OmniOS",
"versions": [
{
"status": "affected",
"version": "r151042",
"lessThan": "r151054",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "r151058w",
"status": "unaffected"
}
],
"version": "r151058",
"lessThan": "r151058w",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "r151056aw",
"status": "unaffected"
}
],
"version": "r151056",
"lessThan": "r151056aw",
"versionType": "custom"
},
{
"status": "affected",
"changes": [
{
"at": "r151054bw",
"status": "unaffected"
}
],
"version": "r151054",
"lessThan": "r151054bw",
"versionType": "custom"
}
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-104117
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #16367 · Revision 1
- Added to Heist Feed
- Publisher date