Certificate Handling Flaw in Samba Software
CVE-2026-3012

8HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 27 May 2026

What is CVE-2026-3012?

A flaw has been identified in how Samba handles certificate auto-enrollment via Group Policy. When this feature is enabled, Samba can retrieve a Certificate Authority (CA) certificate over an unencrypted HTTP connection. It installs this certificate into the local trust store without conducting appropriate verification processes. This vulnerability could be exploited by an attacker capable of intercepting or redirecting the network traffic, allowing them to provide a fraudulent certificate authority certificate. This could lead to the interception or spoofing of secure communications, undermining the trust that users place in the software.