CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

Red Hat Product Security has rated this vulnerability as having an Important security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC)

Red Hat Enterprise Linux (RHEL) context: Standard installations of Red Hat Enterprise Linux (RHEL) are not affected. RHEL packages Samba strictly to operate as a file server (smbd), print server, or Active Directory domain member (winbindd). RHEL does not ship or support the Samba Active Directory Domain Controller (AD DC) role where this LDAP Compare request flaw exists.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.