Samba Patches Critical Domain Takeover Flaws in Coordinated Release Across All Active Branches
The Samba Team released three coordinated security updates on July 28, 2026. Versions 4.24.5, 4.23.10, and 4.22.11 are now available. They address six CVEs affecting Samba Active Directory domain controllers running any version from 4.0 onward.
The two most severe flaws both carry CVSS scores of 8.8. They were found by OpenAI Security Research. Each allows an authenticated low-privilege user to escalate privileges or extract cryptographic keys, potentially leading to full domain compromise.
No workarounds exist for the critical issues. If you are running Samba AD DC, you need to patch immediately.
The Headliners
CVE-2026-58221 enables authenticated LDAP access domain takeover. The flaw lets a low-privilege domain user modify internal LDB special DNs like @MODULES and @PARTITION.
The attack chain is straightforward. You modify @MODULES/@LIST to replace the DSDB module chain for new LDAP connections. You then omit the acl and aclread modules. ACL enforcement vanishes. Next, you add yourself to protected administrator groups like Domain Admins or Enterprise Admins.
Full domain takeover follows. There is no way to mitigate this without upgrading. Audit logs should show unusual modification timestamps on sam.ldb and LDAP operations targeting DNs that start with @.
CVE-2026-58222 is equally dangerous. It combines LDAP Compare filter injection with a trusted search context bypass. Samba builds search filters via talloc_asprintf() without validating attribute names or escaping assertion values.
Attacker-controlled input containing filter operators like >= forces Samba to evaluate non-equality comparisons against arbitrary attributes. The internal LDB search generated by Compare is not marked as "untrusted." ACL visibility checks get skipped.
The primary target is msKds-RootKeyData. This attribute holds the root secret for the Group Key Distribution Service. Extracting the key allows offline derivation of all gMSA passwords. If a privileged gMSA exists in your environment, full domain compromise is possible.
It is worth noting that OpenAI Security Research also reported the second critical flaw. The team apparently decided to turn their attention toward infrastructure security for a bit. Their findings highlight vulnerabilities that have likely been lurking in AD implementations for years.
Other Issues
The remaining four CVEs cover DNS, KDC, and CTDB.
CVE-2026-58218 allows unauthenticated attackers to flood the Samba DNS server with TKEY registration requests. The cache used to filter TSIG requests fills up. Legitimate TKEYs get expunged. DNS TSIG signing becomes impossible for authenticated users.
This flaw amplifies CVE-2026-6949 by removing the authentication requirement. A crafted TSIG packet can now crash the DNS server without valid credentials.
CVE-2026-6949 itself involves incorrect size calculations when a TSIG record contains compressed DNS names. The result is an out-of-bounds write large enough to crash the Samba DNS process.
CVE-2026-58216 lets authenticated users crash the KDC process via malformed ASN.1 in a Kerberos kpasswd packet. The server reads up to 6 bytes of unallocated memory. No data disclosure is possible, but availability takes a hit.
CVE-2026-58224 affects CTDB protocol integrity checks. Missing field-length validations and NUL-termination edge-case checks during unmarshalling can lead to DoS or limited disclosure of adjacent memory allocations. Impact is mitigated if CTDB private network traffic is properly isolated from client networks.
Assessment
The Samba Team patched quickly. Six flaws across three active branches on the same day is a solid response. Stefan Metzmacher handled the patching for four of the CVEs. The coordinated release ensures no branch is left exposed.
Enterprises relying on the 4.22.x line should prioritize the upgrade. Long-term maintenance support for that branch is still active. Organizations running Samba as a DNS server with TSIG-signed zones should patch first due to the unauthenticated DoS capability.
Download Links
Head here to grab the tarballs and patch diffs.
- 4.24.5: samba-4.24.5.tar.gz | Diffs | Signature
- 4.23.10: samba-4.23.10.tar.gz | Diffs | Signature
- 4.22.11: samba-4.22.11.tar.gz | Diffs | Signature
Full advisory details are available on the Samba security page.
