LDAP Filter Injection Vulnerability in Samba Active Directory Domain Controller

CVE-2026-58222

What is CVE-2026-58222?

CVE-2026-58222 is a significant vulnerability found in the Samba Active Directory Domain Controller, which is a widely used software for providing file and print services to SMB/CIFS clients. This vulnerability arises from a combination of LDAP filter injection and improper authorization checks when processing LDAP Compare requests. Specifically, Samba fails to adequately validate user-supplied attribute names, allowing an attacker—who is already authenticated as a low-privilege domain user—to exploit this flaw. By executing an internal database search in a trusted context, the attacker can bypass normal Access Control List (ACL) enforcement, gaining access to sensitive Active Directory attributes that should be protected.

This vulnerability poses a serious threat to organizations because it can allow unauthorized disclosure of confidential information within the Active Directory. The revealed data can aid attackers in deriving sensitive authentication material, potentially facilitating privilege escalation and leading to complete domain compromise. In particular, configurations utilizing Group Managed Service Accounts (gMSAs) are particularly vulnerable, as attackers can extract critical information like the "msKds-RootKeyData" attribute, which can be exploited to derive gMSA passwords offline.

Potential Impact of CVE-2026-58222

1. Unauthorized Access to Sensitive Information: The exploitation of this vulnerability allows low-privileged users to gain access to sensitive attributes in the Active Directory, which can include confidential user information and other security credentials.

2. Privilege Escalation: By extracting sensitive data such as the gMSA passwords, attackers can escalate their privileges within the domain, granting them broader access to network resources, which could lead to further compromises of other systems.

3. Complete Domain Compromise: If attackers successfully leverage the information obtained through this vulnerability, they can achieve complete control over the domain, posing severe risks to organizational security, including data breaches and potential disruptions to business operations.

References