Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-58222 EUVD-2026-51158GHSA-fcqv-6jgj-4xxc

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Enterprise Linux 10 Product: Red Hat Enterprise Linux 6 Product: Red Hat Enterprise Linux 7 Product: Red Hat Enterprise Linux 8 Product: Red Hat Enterprise Linux 9 Product: Red Hat OpenShift Container Platform 4 Package: samba Package: samba Package: samba Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift Container Platform 4 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 samba 2:4.24.5+dfsg-1 —
Debian 13 samba 2:4.22.10+dfsg-0+deb13u2 —
Debian 12 samba No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS samba 2:4.23.6+dfsg-1ubuntu2.2 —
Ubuntu 24.04 LTS samba 2:4.19.5+dfsg-4ubuntu9.7 —
Ubuntu 22.04 LTS samba 2:4.15.13+dfsg-0ubuntu1.13 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS samba No fix yet —
Ubuntu Pro 18.04 LTS samba No fix yet —
Ubuntu Pro 16.04 LTS samba No fix yet —
Ubuntu Pro 14.04 LTS samba No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 samba 4.21.10+git.533.31d7e5508d-150700.3.29.1 SUSE-SU-2026:3363-1
SLES 15 SP6 samba 4.19.8+git.501.67274891bc-150600.3.29.1 SUSE-SU-2026:3364-1
SLES 15 SP5 samba 4.17.12+git.581.f49579c6cd-150500.3.42.1 SUSE-SU-2026:3365-1
SLES 15 SP4 samba 4.15.13+git.808.eeca19f5e1-150400.3.52.1 SUSE-SU-2026:3362-1
SLES 12 SP5 samba 4.15.13+git.729.a8ce057e8d-3.109.1 SUSE-SU-2026:3367-1
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 samba 4.22.11+git.552.66cfeb7de0a-160000.1.1 SUSE-SU-2026:23152-1, SUSE-SU-2026:23129-1
SLES for SAP 15 SP6 samba 4.19.8+git.501.67274891bc-150600.3.29.1 SUSE-SU-2026:3364-1
SLES for SAP 15 SP5 samba 4.17.12+git.581.f49579c6cd-150500.3.42.1 SUSE-SU-2026:3365-1
SLES for SAP 15 SP4 samba 4.15.13+git.808.eeca19f5e1-150400.3.52.1 SUSE-SU-2026:3362-1
SLES 16.0 samba 4.22.11+git.552.66cfeb7de0a-160000.1.1 SUSE-SU-2026:23152-1, SUSE-SU-2026:23129-1
SLE Micro 6.2 samba 4.22.9+git.538.af6cb4fb2e-160000.1.1 SUSE-SU-2026:23003-1, SUSE-SU-2026:22977-1
SLE Micro 5.5 samba 4.17.12+git.581.f49579c6cd-150500.3.42.1 SUSE-SU-2026:3365-1
SLE Micro 5.4 samba 4.15.13+git.808.eeca19f5e1-150400.3.52.1 SUSE-SU-2026:3362-1
SLE Micro 5.3 samba 4.15.13+git.808.eeca19f5e1-150400.3.52.1 SUSE-SU-2026:3362-1
SLE HPC 15 SP5 samba 4.17.12+git.581.f49579c6cd-150500.3.42.1 SUSE-SU-2026:3365-1
SLE HPC 15 SP4 samba 4.15.13+git.808.eeca19f5e1-150400.3.52.1 SUSE-SU-2026:3362-1
SUSE Enterprise Storage 7.1 samba 4.15.13+git.808.eeca19f5e1-150300.3.106.1 SUSE-SU-2026:3366-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed samba 4.24.5+git.481.dba78dbdea-1.1 openSUSE-SU-2026:11431-1
openSUSE Leap 16.0 samba 4.22.9+git.538.af6cb4fb2e-160000.1.1 openSUSE-SU-2026:21540-1, openSUSE-SU-2026:21475-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 ctdb +26 4.10.16-24.amzn2.0.9 ALAS2-2026-3886

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 samba No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • abdelaaziz0/KDSExtract ★ 0 · Oct 13, 2026

    Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 15

References