# CVE-2026-44058: Netatalk authentication bypass in admin auth user fallback

Source: https://junglewise.ai/threats/cve-2026-44058-netatalk-authentication-bypass-in-admin-auth-user-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44058 · Severity: high · CVSS 7.2 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to allow Unix-like systems to serve files to macOS clients. A security flaw in the administrative authentication fallback mechanism allows a user with the administrator password to log in as any other user on the system. This could lead to unauthorized access to sensitive user data or full system compromise if an attacker gains administrative credentials.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44058 being exploited in the wild.

**How severe is CVE-2026-44058?** High severity, with a CVSS score of 7.2, published 21 May 2026.

**Which products and versions are affected?** Netatalk 2.2.2 through 4.4.2.

**Is there a fix for CVE-2026-44058?** A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44058 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44058?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability (CWE-287) exists in Netatalk versions 2.2.2 through 4.4.2 due to the way the 'admin auth user' fallback is handled in the AFP configuration. When this feature is enabled, the administrative password can be used to authenticate as any requested user on the system. While the attack requires knowledge of the administrative password (PR:H), it allows for complete impersonation of other users. The issue is resolved in Netatalk version 4.5.0, and a hotfix patch is available for version 4.4.2. Users are advised to avoid setting 'admin auth user' in afp.conf unless strictly necessary.

## Affected products

- Netatalk Netatalk 2.2.2 through 4.4.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0

## References

- [https://netatalk.io/security/CVE-2026-44058](https://netatalk.io/security/CVE-2026-44058)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)