Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-28T10:00:00 samba: Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-90

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

Red Hat Product Security has rated this vulnerability as having an Important security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) ``` Red Hat Enterprise Linux (RHEL) context: Standard installations of Red Hat Enterprise Linux (RHEL) are not affected. RHEL packages Samba strictly to operate as a file server (smbd), print server, or Active Directory domain member (winbindd). RHEL does not ship or support the Samba Active Directory Domain Controller (AD DC) role where this LDAP Compare request flaw exists. ``` Red Hat would like to thank Andrew Tridgell (Samba Team), Bin Luo (University of Electronic Science and Technology of China (UESTC)), OpenAI Security Research, and Tristan Madani (Talence Security) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Not affected samba Red Hat Enterprise Linux 6 Not affected samba Red Hat Enterprise Linux 6 Not affected samba4 Red Hat Enterprise Linux 7 Not affected samba Red Hat Enterprise Linux 8 Not affected samba Red Hat Enterprise Linux 9 Not affected samba Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-58222 https://nvd.nist.gov/vuln/detail/CVE-2026-58222 https://bugzilla.samba.org/show_bug.cgi?id=16148 https://www.samba.org/samba/security/CVE-2026-58222.html