Missing Authorization Check in illumos IP Management Daemon Affects Network Configuration

CVE-2026-104117

What is CVE-2026-104117?

The illumos IP management daemon (ipmgmtd) contains a vulnerability due to a missing authorization check that permits local users to alter the persistent IP multipathing (IPMP) configuration. This flaw occurs within the door dispatch table where necessary authorization for the IPMGMT_CMD_IPMP_UPDATE command is not enforced. As a result, unprivileged local users can manipulate IPMP group memberships in the stored configuration, which may lead to potential disruptions in network connectivity upon the next application of the stored configuration, such as during a reboot. This issue has persisted since 2021 and impacts all illumos distributions prior to the relevant patch.

References