Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12249— Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment

Quick assessment

Affected
CVE-2026-12249
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Canonical Ubuntu是英国Canonical公司的一款Linux操作系统。 Canonical adsys存在信任管理问题漏洞，该漏洞源于在Active Directory证书自动注册过程中使用明文HTTP连接而非HTTPS请求CA证书，可能导致中间人攻击，通过拦截HTTP请求提供任意CA证书，造成系统信任库中毒，使TLS客户端接受任意域恶意证书。

CVSS 8.3 · Critical EPSS 0.14% · P3

Affected Version Matrix 6

VendorProduct Version RangeStatus
None None 0.13.0< 0.16.3 affected
Canonical Ubuntu 20.04 LTS 0.9.2~20.04.2ubuntu0.1+esm2 unaffected
Canonical Ubuntu 22.04 LTS 0.16.3~22.04.2ubuntu0.22.04.1 unaffected
Canonical Ubuntu 24.04 LTS 0.16.3~24.04.2ubuntu0.24.04.1 unaffected
Canonical Ubuntu 25.10 0.16.3 unaffected
Canonical Ubuntu 26.04 LTS 0.16.4ubuntu1 unaffected

I. Basic Information for CVE-2026-12249

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不可信的源
Source: CVE Program / CVE List V5
Vulnerability Title
Canonical adsys 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical Ubuntu是英国Canonical公司的一款Linux操作系统。 Canonical adsys存在信任管理问题漏洞，该漏洞源于在Active Directory证书自动注册过程中使用明文HTTP连接而非HTTPS请求CA证书，可能导致中间人攻击，通过拦截HTTP请求提供任意CA证书，造成系统信任库中毒，使TLS客户端接受任意域恶意证书。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.13.0 ~ 0.16.3 -
Canonical Ubuntu 20.04 LTS - -
Canonical Ubuntu 22.04 LTS 0.16.3~22.04.2ubuntu0.22.04.1 -
Canonical Ubuntu 24.04 LTS 0.16.3~24.04.2ubuntu0.24.04.1 -
Canonical Ubuntu 25.10 - -
Canonical Ubuntu 26.04 LTS - -

II. Public POCs for CVE-2026-12249

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 13330 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-12249

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12249 (1)

Vendor Advisories for CVE-2026-12249 (1)

IV. Related Vulnerabilities

Same weakness: CWE-348

V. Comments for CVE-2026-12249

No comments yet

Leave a comment