CVE-2026-104113

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

• CWE-415

• https://github.com/TritonDataCenter/illumos-joyent/commit/TBD
• https://github.com/omniosorg/illumos-omnios/commit/670d853f335203ce8a66126cdbb25bfdba973036
• https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104079Envira Gallery Lite before 1.16.2 contains a missing authori…4.3
• CVE-2026-104081KodExplorer before 4.55 contains a path traversal vulnerabil…8.1
• CVE-2026-104082SmarterMail before build 9777 contains a remote code executi…7.2
• CVE-2026-104083SmarterMail before build 9777 contains a stored mutation cro…6.1
• CVE-2026-104084SmarterMail before build 9777 contains a privilege escalatio…8.8
• CVE-2026-104112A missing release of resources in the illumos name service c…6.8
• CVE-2026-104114A NULL pointer dereference in the illumos Network Auto-Magic…5.4
• CVE-2026-104115A stack-based buffer overflow in the illumos reparse point d…5.4
• CVE-2026-104116A missing authorization check in the illumos zones statistic…1.9
• CVE-2026-104117A missing authorization check in the illumos IP management d…1.9
• CVE-2026-104118The Razorpay for WooCommerce WordPress plugin before 4.8.8 d…5.3
• CVE-2026-104119The Simple Shopping Cart WordPress plugin before 5.2.6 does …3.5