CVE-2026-58222: Samba AD DC LDAP Filter Injection Leads to Privilege Escalation

Vulnerability Overview CVE Identifier: CVE-2026-58222 Description: A security vulnerability has been identified in the handling of LDAP Compare requests within Samba Active Directory Domain Controllers (AD DCs). This issue combines LDAP filter injection with improper authorization checks. Samba fails to properly validate user-provided attribute names and executes internal database searches in a trusted context, bypassing normal Access Control List (ACL) enforcement. Authenticated, low-privilege domain users can exploit this flaw to disclose confidential Active Directory attributes that are typically inaccessible. The disclosed information may be used to infer sensitive authentication materials, leading to privilege escalation and complete domain compromise. For example, in deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the attribute and derive the gMSA password offline, potentially resulting in complete domain compromise if privileged gMSAs exist. Affected Products Product: Samba Active Directory Domain Controller (AD DC) Severity: Important Affected Environments: Standard installations of Red Hat Enterprise Linux (RHEL) are not affected because the RHEL package runs Samba strictly as a file server ( ), print server, or Active Directory domain member ( ). RHEL does not ship or support the Samba Active Directory Domain Controller (AD DC) role, where this LDAP Compare request vulnerability exists. Remediation Fix Status: The page does not provide specific remediation steps or patch information. Recommended Actions: Users are advised to monitor the Red Hat Product Security Center for the latest security updates and patch information. Additional Information CVSS Score: The CVSS v3.1 score is 8.8. Attack Vector: Network; Attack Complexity: Low; Privileges Required: Low; User Interaction: None; Scope: Unchanged; Confidentiality Impact: High; Integrity Impact: High; Availability Impact: High. CWE Identifier: CWE-90 Technical Impact: Execution of unauthorized code or commands; Reading application data; Modifying application data. Credits: Thanks to Andrew Tridgell (Samba Team), Bin Luo (University of Electronic Science and Technology of China), and Tristan Madani (Talentec Security) for reporting this issue. Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “Under Investigation” or “Affected.” When will Red Hat release a fix for this vulnerability? What can I do if my product is listed as “Not Fixable”? What can I do if my product is listed as “Fix Deferred”? What are mitigation strategies? I have a Red Hat product, but it is not listed above. Is it affected? Why does my security scanner report that my product is vulnerable to this flaw, even if my product version is fixed or not affected? Contact Information Contact: For clarifications or corrections, contact Red Hat Product Security. Last Modified: 2021 Copyright: CVE descriptions copyright © 2021

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-58222: Samba AD DC LDAP Filter Injection Leads to Privilege Escalation

More from this source