Samba 4.23.11 ships with five bundled CVEs and critical Active Directory security patches
The latest stable point release locks down two 8.8-rated vulnerabilities that enable full domain takeovers, plus wraps up CephFS and CTDB stability work.
Samba has dropped version 4.23.11, a stable point release that bundles fixes for five previously disclosed security vulnerabilities alongside a heavy dose of operational corrections. If you're running Samba AD DC in production, this is the build you should deploy first.
The 4.23 series has seen twelve point releases in roughly eleven months. That cadence signals active maintenance rather than a branch being quietly deprecated. Released on August 3, 2026, 4.23.11 supersedes the July 28 update. The full tarball clocks in at just over 41 megabytes, and the project is shipping both complete downloads and incremental patches for anyone migrating from 4.23.10.
Critical security flaws
Two of the bundled CVEs sit at 8.8 out of 10. CVE-2026-58221 allows a low-privilege authenticated user to rewrite internal LDB records and hijack an entire Active Directory domain. CVE-2026-58222 abuses a filter injection flaw in the LDAP Compare path to pull Group Managed Service Account root keys. On any Samba install from 4.21.0 onward, that translates to offline credential cracking and complete domain compromise. Both were reported by OpenAI Security Research. No workaround exists. You need to patch immediately.
The other three vulnerabilities round out the medium and high severity tiers. CVE-2026-58216 and 58218 cover a malformed ASN.1 packet that crashes the KDC and an unauthenticated TKEY cache flood that starves legitimate TSIG signers. CVE-2026-58224 bumps the severity to 7.1, flagging missing bounds checks in CTDB's private network protocol. That one can crash clustered file servers or leak adjacent memory. Talence Security reported the first two, while OpenAI Security Research also flagged the third.
It's a rather aggressive security surface to bundle into a single point release, though the project historically ships CVE fixes across multiple advisory pages before folding them into a stable tarball. Keep in mind that 4.23.11 does not cover CVE-2026-4408, 4480, or 6949. Those affect the newer 4.24.x branch and shipped in 4.24.5. If you're already on 4.24, you're likely past this. If you're still on 4.22 or older, you're overdue for a much larger jump. However, at the same time, the project's patching cadence means you should lock down the upgrade window before the next advisory drops.
Stability and infrastructure fixes
Security isn't the only reason to upgrade. The patch set tackles a string of operational headaches that have been rattling production environments. Ralph Boehme closed a DRS memory leak that triggers whenever replication fails. Volker Lendecke ironed out a pthreadpool race condition inside winbindd. Stefan Metzmacher and Andreas Schneider pushed fixes across authentication trusts, DFS code paths, and a C26 compliance sweep that silences compiler warnings across the tree. Martin Schwenke cleaned up CTDB tickle ACK handling and a rare nested election bug that could destabilize failover clusters.
Matthias Grandl addressed two separate CephFS VFS panics. The first trips when a client accesses a snapshot on a share mounted at the CephFS root. The second crashes smbd when you mix proxy and non-proxy CephFS shares. If your backend storage sits on Ceph, those two were probably keeping your on-call engineer awake at 2 AM. Not cheap to debug either.
There's also a practical fix for a trust regression. BUG 16067 notes that requiring NTLMv2 session security on Windows clients previously broke trust relationships to Samba. That matters for shops doing hybrid Windows Server AD migrations. Samba's open-source AD stack has been quietly eating into Microsoft territory for years, and trust breakage in production environments is exactly the kind of friction that makes IT directors reach for the familiar alternative.
Head here to grab the full tarball, the GPG signature, or the incremental patch from 4.23.10. Git users should check out the refs/tags/v4.23.11 ref on git.samba.org. Verify the signatures before building. As always with authentication stack changes, test in staging first.
