Skip to main content

Samba AD DC CVE-2026-58222

| EUVDEUVD-2026-51158 HIGH
LDAP Injection (CWE-90)
2026-07-30 redhat GHSA-fcqv-6jgj-4xxc
Privilege Escalation LDAP Code Injection Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Suse Red Hat
8.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Authenticated domain user (PR:L) over the network (AV:N/AC:L) directly gains attribute disclosure (C:H); integrity/availability impact is a downstream gMSA-chaining consequence, not direct, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 16:21 vuln.today
CVE Published
Jul 30, 2026 - 15:11 cve.org
HIGH 8.8

DescriptionCVE.org

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

AnalysisAI

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.

Technical ContextAI

The flaw resides in Samba's AD DC LDAP server, which implements the LDAP directory protocol backed by an internal database (LDB). LDAP Compare operations test whether an attribute holds a given value; here Samba does not properly validate the attribute name supplied by the client before constructing and executing the internal search, and it performs that search in a trusted/system context rather than the caller's security context. This is a classic CWE-90 LDAP Injection combined with an authorization (ACL) bypass: the security descriptors that normally gate which attributes a low-privileged principal may read are not applied. The most damaging target is msKds-RootKeyData, the KDS root key used by the Group Managed Service Account (gMSA) subsystem - once an attacker reads this normally SYSTEM-only attribute, gMSA passwords can be recomputed offline using the documented gMSA key-derivation scheme. The affected CPEs enumerate Red Hat products (RHEL 6 through 10 and OpenShift Container Platform 4) because those distributions ship the vulnerable Samba packages; the underlying vulnerable component is Samba itself as tracked upstream (bugzilla.samba.org #16148).

RemediationAI

Patch available per vendor advisory - apply the updated Samba packages from your distribution: Red Hat customers should follow access.redhat.com/security/cve/CVE-2026-58222 (tracking bug bugzilla.redhat.com/show_bug.cgi?id=2502722) and Ubuntu users should install the update from USN-8621-1 (ubuntu.com/security/notices/USN-8621-1); refer to the upstream Samba advisory at www.samba.org/samba/security/CVE-2026-58222.html for source builds. Exact fixed version strings are not included in the provided data, so pull the precise patched build from your distributor's advisory rather than assuming a number. Because a patch exists, upgrading is the correct primary action; if patching must be delayed, compensating controls include rotating the gMSA KDS root key and rotating/retiring privileged gMSA accounts after patching (offline-derived passwords remain valid until the underlying key material changes), and tightening which accounts can bind to the DC - note that restricting low-privilege LDAP access is difficult in AD because all domain users must authenticate, so network-level segmentation of DC LDAP ports (389/636) to trusted management ranges is only a partial mitigation and can break legitimate clients. Monitoring for anomalous LDAP Compare volume against sensitive attributes is a detection stopgap, not a fix.

More in LDAP

View all
CVE-2016-9299 CRITICAL POC
9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL POC
9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
CVE-2023-28853 MEDIUM POC
6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
CVE-2020-36966 MEDIUM POC
6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
CVE-2025-36556 MEDIUM POC
6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
CVE-2026-23906 CRITICAL
9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
CVE-2026-44930 CRITICAL
9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
CVE-2024-33868 CRITICAL
9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-6905 CRITICAL
9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
CVE-2021-43350 CRITICAL
9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
CVE-2026-46619 CRITICAL
9.3 Jun 26

Authentication bypass in Open Identity Platform OpenAM Community Edition (through 16.0.6) lets an unauthenticated remote

Same weakness CWE-90 – LDAP Injection

View all
CVE-2016-9299 CRITICAL POC
9.8
CVE-2017-14596 CRITICAL POC
9.8
CVE-2017-8790 CRITICAL POC
9.8
CVE-2023-28853 MEDIUM POC
6.5
CVE-2026-44930 CRITICAL
9.8
CVE-2024-33868 CRITICAL
9.8
CVE-2023-6905 CRITICAL
9.8
CVE-2021-43350 CRITICAL
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/samba-client:latest Container suse/samba-toolbox:latest Affected
Container suse/samba-server:latest Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP7-BYOS-EC2 Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2026-58222 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy