Executive brief
Samba is an open-source software suite that provides file and print services, as well as Active Directory domain controller capabilities, for Linux and Unix systems. A security vulnerability has been identified where an authenticated user with low privileges can bypass security restrictions to access sensitive information stored in the directory. This could allow an attacker to extract administrative passwords or encryption keys, potentially leading to a full takeover of the corporate network domain.
Technical details
Samba AD DC contains two flaws in its handling of LDAP Compare requests. First, a filter injection vulnerability (CWE-90) exists because the `ldapsrv_CompareRequest` function constructs LDB filters using `talloc_asprintf` without escaping user-provided attribute names or assertion values. Second, an improper authorization flaw (CWE-863) occurs because these internal search requests are not marked as 'untrusted' via `ldb_req_mark_untrusted()`, causing them to execute in a trusted context that bypasses Access Control List (ACL) enforcement. An authenticated attacker can combine these flaws to create a 'disclosure oracle,' using ordered comparison operators (e.g., '>=') to perform binary searches for protected attributes. This can be used to extract sensitive data such as 'msKds-RootKeyData' in gMSA environments, LAPS passwords, or password hashes, enabling offline credential derivation and privilege escalation.
Affected products
- Samba Samba 4.0.0 and later
- Red Hat Enterprise Linux 6 samba, samba4
- Red Hat Enterprise Linux 7 samba
- Red Hat Enterprise Linux 8 samba
- Red Hat Enterprise Linux 9 samba
- Red Hat Enterprise Linux 10 samba
- Red Hat OpenShift Container Platform 4 rhcos
Timeline
- 2026-06-24: disclosed: Initial report to Samba by Douglas Bagnall
- 2026-07-29: patched: Samba bug 16148 resolved fixed
- 2026-07-30: advisory: Public disclosure and NVD publication