CVE-2026-58222: Samba AD DC LDAP filter injection and ACL bypass in Compare requests

CVE-2026-58222 · Severity: high · CVSS 8.8 · Published 2026-07-30

Samba is an open-source software suite that provides file and print services, as well as Active Directory domain controller capabilities, for Linux and Unix systems. A security vulnerability has been identified where an authenticated user with low privileges can bypass security restrictions to access sensitive information stored in the directory. This could allow an attacker to extract administrative passwords or encryption keys, potentially leading to a full takeover of the corporate network domain.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Samba. Vendors: Red Hat, Samba.

Quick answers

Is CVE-2026-58222 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58222 being exploited in the wild.
How severe is CVE-2026-58222?
High severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 samba; Red Hat Enterprise Linux 6 samba, samba4; Red Hat Enterprise Linux 7 samba; Red Hat Enterprise Linux 8 samba; and 3 more.
Is there a fix for CVE-2026-58222?
A patch was published on 2026-07-29: Samba bug 16148 resolved fixed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58222 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58222?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Samba AD DC contains two flaws in its handling of LDAP Compare requests. First, a filter injection vulnerability (CWE-90) exists because the `ldapsrv_CompareRequest` function constructs LDB filters using `talloc_asprintf` without escaping user-provided attribute names or assertion values. Second, an improper authorization flaw (CWE-863) occurs because these internal search requests are not marked as 'untrusted' via `ldb_req_mark_untrusted()`, causing them to execute in a trusted context that bypasses Access Control List (ACL) enforcement. An authenticated attacker can combine these flaws to create a 'disclosure oracle,' using ordered comparison operators (e.g., '>=') to perform binary searches for protected attributes. This can be used to extract sensitive data such as 'msKds-RootKeyData' in gMSA environments, LAPS passwords, or password hashes, enabling offline credential derivation and privilege escalation.

Affected products

  • Samba Samba 4.0.0 and later
  • Red Hat Enterprise Linux 6 samba, samba4
  • Red Hat Enterprise Linux 7 samba
  • Red Hat Enterprise Linux 8 samba
  • Red Hat Enterprise Linux 9 samba
  • Red Hat Enterprise Linux 10 samba
  • Red Hat OpenShift Container Platform 4 rhcos

Timeline

  • 2026-06-24: disclosed: Initial report to Samba by Douglas Bagnall
  • 2026-07-29: patched: Samba bug 16148 resolved fixed
  • 2026-07-30: advisory: Public disclosure and NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.