EUVD-2026-51158
GHSA-fcqv-6jgj-4xxc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated domain user (PR:L) over the network (AV:N/AC:L) directly gains attribute disclosure (C:H); integrity/availability impact is a downstream gMSA-chaining consequence, not direct, so I:N/A:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.
AnalysisAI
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privilege domain account (CVSS PR:L) that can reach the Samba AD DC's LDAP service over the network; no user interaction and no elevated privileges are needed to trigger the disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction - realistic for any environment where ordinary domain users authenticate to a DC. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or been issued any ordinary domain account authenticates to a Samba AD DC and issues crafted LDAP Compare requests with injected attribute names, causing the server to evaluate them in a trusted context and leak attributes the account should not see. In a gMSA-using domain the attacker reads msKds-RootKeyData, derives the passwords of privileged Group Managed Service Accounts offline, and reuses them to escalate toward domain compromise. … |
| Remediation | Patch available per vendor advisory - apply the updated Samba packages from your distribution: Red Hat customers should follow access.redhat.com/security/cve/CVE-2026-58222 (tracking bug bugzilla.redhat.com/show_bug.cgi?id=2502722) and Ubuntu users should install the update from USN-8621-1 (ubuntu.com/security/notices/USN-8621-1); refer to the upstream Samba advisory at www.samba.org/samba/security/CVE-2026-58222.html for source builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Samba AD DC instances in your environment and identify deployments with gMSA enabled; notify domain administrators and prepare patch deployment procedures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au
Same weakness CWE-90 – LDAP Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today