CVE-2026-58222

Awaiting Analysis Awaiting Analysis - Queue

LDAP Filter Injection and Authorization Bypass in Samba AD DC

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Red Hat, Inc.

Description

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-58222

EUVD

EUVD-2026-51158

Affected Vendors & Products

Vendor	Product	Version / Range
samba	samba	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a combination of LDAP filter injection and improper authorization checks in Samba Active Directory Domain Controller. It allows an authenticated low-privilege user to bypass ACL enforcement and access confidential Active Directory attributes that should be restricted. The flaw occurs during LDAP Compare requests where user-supplied attribute names are not properly validated.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized LDAP Compare requests or unusual access to protected attributes like msKds-RootKeyData. Monitor Samba logs for suspicious LDAP queries and verify ACL enforcement. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to disclose sensitive Active Directory attributes, potentially deriving authentication material like gMSA passwords. This could lead to privilege escalation and complete domain compromise if privileged accounts are targeted.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive Active Directory attributes, including confidential user or system data. For GDPR, this may violate principles of data minimization and security, risking unauthorized access to personal data. For HIPAA, exposure of authentication material or privileged account details could compromise protected health information security.

Mitigation Strategies

Apply the latest Samba security patches immediately. Review and restrict LDAP Compare request permissions for low-privilege users. Audit Active Directory attributes for unauthorized access attempts. Monitor for unusual LDAP query patterns or attribute disclosures.

Hi! I’m here to help you understand CVE-2026-58222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70