CVE-2026-58221

A flaw was found in Samba Active Directory Domain Controller (AD DC). Improper authorization checks allow an authenticated low-privilege domain user to modify internal LDB special records through LDAP. By altering the DSDB module configuration, an attacker can bypass directory ACL enforcement on new LDAP connections and elevate privileges, potentially leading to complete domain compromise.

Red Hat Product Security has rated this vulnerability as having an Important security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC).

Red Hat Enterprise Linux (RHEL) context: Default installations of Red Hat Enterprise Linux (RHEL) are not affected. RHEL does not ship or support the Samba Active Directory Domain Controller (AD DC) role where this internal LDB filtering flaw exists.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.