Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send unauthenticated TKEY DNS requests
  2. Delivery
    Cache entries inserted pre-validation
  3. Exploit
    Flood cache with arbitrary names
  4. Execution
    Evict legitimate TKEY entries
  5. Persist
    TSIG authentication fails for valid clients
  6. Impact
    DNS-dependent AD services disrupted

Vulnerability Assessment

Weakness
CWE
CWE-410
ASVS 5.0
V2 - Validation and Business Logic Insufficient resource pool
Exploitation Conditions

Exploitation requires that the targeted Samba instance is configured to use Samba's internal DNS server backend (the default for Samba AD DC deployments; not applicable when BIND or an external DNS is used as the AD DNS backend). The attacker must have network access to UDP or TCP port 53 on the Samba DNS listener. No authentication is required. The impact is limited to the TSIG authentication path - unauthenticated DNS queries and non-TSIG lookups continue to function. Exploitation is therefore bounded to environments running Samba as an AD Domain Controller with the built-in DNS backend enabled, and the resulting DoS affects only TSIG-reliant clients.
Impact

The CVSS 3.1 base score of 5.3 (Medium) reflects a purely network-delivered, unauthenticated, zero-complexity attack with only limited availability impact - consistent with a resource exhaustion DoS rather than code execution. The AV:N/AC:L/PR:N/UI:N vector confirms the attack is trivially reachable with no prerequisites beyond network access to port 53. The C:N/I:N/A:L ratings correctly scope the impact: confidentiality and integrity are unaffected; availability impact is partial because only TSIG-reliant DNS authentication is disrupted, not the entire DNS service. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC is referenced. Real-world priority should be elevated for Samba AD DC operators because TSIG failure can cascade into Kerberos and domain join failures, but this is a low-severity, medium-prevalence issue absent active exploitation evidence.
Exploit ScenarioDerived

An unauthenticated attacker on the network sends a high-rate stream of DNS TKEY requests carrying arbitrary, unique names to Samba's DNS listener on port 53. Each request is inserted into the finite TKEY name cache before Samba's validation logic rejects it, causing the cache to fill with attacker-controlled junk entries that displace legitimate TKEY state. Domain-joined clients or DNS secondaries attempting TSIG-authenticated queries find their cached TKEY entries evicted and are unable to complete authentication, resulting in DNS query failures that can cascade into Kerberos and Active Directory service disruption.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.

RemediationAI

Apply the vendor-released patch from Samba upstream (https://www.samba.org/samba/security/CVE-2026-58218.html) or via your Linux distribution's package manager - Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58218, Ubuntu at https://ubuntu.com/security/notices/USN-8621-1. Exact patched Samba version numbers were not specified in the input data and should be confirmed against those advisories before deployment. As a compensating control, administrators can restrict inbound DNS TKEY requests at the perimeter firewall or DNS load balancer to trusted source IP ranges, since TSIG key negotiation should only originate from known domain-joined clients and DNS secondaries; this trades some operational flexibility for reduced attack surface. Alternatively, deploying an external DNS server such as BIND as the AD DNS backend rather than Samba's internal DNS eliminates the vulnerable code path entirely, though this requires AD DNS re-delegation and operational overhead.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

TKEY (Transaction KEY) is a DNS record type defined in RFC 2930 used for establishing shared secret keys to enable TSIG (Transaction SIGnature) authentication of DNS messages. Samba's internal DNS server - used when Samba operates as an Active Directory Domain Controller with its built-in DNS backend rather than BIND - maintains a name cache of TKEY entries to facilitate TSIG session setup. CWE-410 (Insufficient Resource Pool) is the root cause: the server adds incoming TKEY request names to this bounded cache prior to performing validation or authorization, meaning even requests destined for rejection consume cache slots. A finite cache filled with attacker-controlled garbage entries displaces legitimate TKEY state needed by authorized clients. Affected CPE strings confirm impact across Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, indicating broad distribution-level exposure to the underlying Samba package.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 5.3 MEDIUM

Network-reachable DNS port, no authentication or complexity required; impact is limited availability loss (TSIG cache only), with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

DescriptionCVE.org

A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.

Threat Intelligence Overview

EPSS Score
1.1%
Top 38% exploitable
Prevalence
Medium
Samba AD DC with internal DNS is common in enterprise Linux environments
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 1.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-410 – Insufficient Resource Pool

View all
CVE-2025-27479 HIGH
7.5
CVE-2025-0453 HIGH POC
7.5
CVE-2023-38505 HIGH POC
7.5
CVE-2021-1615 HIGH
8.6
CVE-2022-2048 HIGH
7.5
CVE-2019-13921 HIGH
7.5
CVE-2019-0056 HIGH
7.5
CVE-2018-13815 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/samba-client:latest Container suse/samba-toolbox:latest Affected
Container suse/samba-server:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-BYOS-EC2 Affected
SUSE Enterprise Storage 7.1 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58218 ADVISORY https://ubuntu.com/security/notices/USN-8621-1 ADVISORY https://vuldb.com/vuln/384811 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22977/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3362/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3363/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3364/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3365/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3366/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3367/ REF https://access.redhat.com/security/cve/CVE-2026-58218 REF https://bugzilla.redhat.com/show_bug.cgi?id=2502728 REF https://bugzilla.samba.org/show_bug.cgi?id=16115 REF https://www.samba.org/samba/security/CVE-2026-58218.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy