This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Samba fixes 6 vulnerabilities

Samba fixes 6 vulnerabilities in versions 4.24.5, 4.23.10 and 4.22.11 [1]. The most severe vulnerabilities are described below; the rest can be found at [2][3][4][5]. Debian releases and their fixed versions [6]: trixie (security) - 2:4.22.10+dfsg-0+deb13u2 sid - 2:4.24.5+dfsg-1

Samba AD DC - privilege escalation (CVE-2026-58221)
CVSS 8.8 (High)

An authenticated remote attacker with a regular domain account can, by sending a specially crafted LDAP request, bypass permission checks (ACL) and escalate their privileges up to domain administrator. Only Samba deployments in the Active Directory Domain Controller (AD DC) role are vulnerable. [7]

The vulnerability is present in product:

  • Samba; >=4.0.0, <4.22.11; >=4.23.0, <4.23.10; >=4.24.0, <4.24.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 7. 2026.

Samba AD DC - domain compromise, privilege escalation (CVE-2026-58222)
CVSS 8.8 (High)

An authenticated remote attacker can, by sending a specially crafted LDAP request, bypass access control (ACL) and read confidential AD attributes including msKds-RootKeyData (the GKDI root key), which on installations with gMSA support (Samba 4.21.0+) can be used to derive the passwords of gMSA accounts and potentially take over the entire domain. Only Samba deployments in the AD DC role are vulnerable. [8]

The vulnerability is present in product:

  • Samba; >=4.0.0, <4.22.11; >=4.23.0, <4.23.10; >=4.24.0, <4.24.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-58222 at cve.org, NVD
  • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 28. 7. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 29. 7. 2026.

CESNET, z.s.p.o. Logo