Samba CVE-2026-3012: Brief Summary of CA Certificate Trust Subversion via Unencrypted HTTP Auto-Enrollment

Introduction

Samba's Group Policy certificate auto-enrollment feature let domain members fetch CA certificates over plaintext HTTP and install them in the local trust store without verifying them. That gave attackers on an adjacent network a way to subvert the entire certificate trust chain. For any organization running Samba 4.16 or later with Group Policy auto-enrollment enabled, a single intercepted HTTP request could let an attacker forge trusted certificates and silently intercept or spoof TLS-protected communications on the affected system.

Technical Information

Root Cause: HTTP Where LDAP Was Already Available

CVE-2026-3012 is in python/samba/gp/gp_cert_auto_enroll_ext.py, the Python module that processes certificate auto-enrollment Group Policy Objects (GPOs) on Samba domain members. The feature was introduced in Samba 4.16.

When a domain member processes the auto-enrollment GPO, it needs a Certificate Authority (CA) certificate to bootstrap the certificate chain. The vulnerable code fetched that certificate over a plaintext HTTP connection, following the URL pattern of Microsoft's Network Device Enrollment Service (NDES), and installed it in the local trust store without any cryptographic validation.

The design error is that NDES exists to serve devices that are not full domain members and so lack access to the directory. Samba domain members already open authenticated, encrypted LDAP sessions to the domain controller as part of GPO processing, and the same CA certificates are available to them in the cACertificate LDAP attribute, which fetch_certification_authorities() retrieves. The HTTP path was kept for compatibility with the Microsoft NDES URL pattern. Domain members never needed it, and it introduced the trust subversion risk.

CVSS Breakdown

The CVSS v3.1 vector is AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, which gives a base score of 8.0 (High).

The "Changed Scope" rating comes from where the certificate ends up. Once the malicious CA certificate is in the system trust store, all applications on that system trust it, not just Samba. The impact therefore extends to HTTPS connections, LDAP over TLS, and any other service that relies on the system certificate store.

Attack Flow

An attacker would exploit this vulnerability in six steps:

1. The attacker gets a presence on the same adjacent network segment (Layer 2 domain or routable subnet) as a Samba domain member. This is the main barrier to exploitation, and it is what the "Adjacent Network" attack vector reflects.

2. The attacker sets up a way to intercept or redirect HTTP traffic from the target, for example through ARP spoofing, DNS poisoning, or a compromised intermediate network device.

3. The Samba domain member processes the certificate auto-enrollment GPO. This happens when apply group policies = yes is set in smb.conf and the auto-enrollment GPO has been configured through the Windows Group Policy Management Editor.

4. The domain member sends a plaintext HTTP request to the NDES endpoint to retrieve the CA certificate. The attacker intercepts the request and responds with a malicious CA certificate under their control.

5. Samba installs the attacker-supplied CA certificate into the local trust store without checking its authenticity or chain of trust.

6. With the malicious CA now trusted system-wide, the attacker can forge certificates for arbitrary services and run man-in-the-middle attacks against TLS-protected communications, including LDAP, HTTPS, and other certificate-validated services. The malicious CA stays in the trust store until someone removes it by hand, which gives the attacker durable persistence.

This attack pattern maps to MITRE ATT&CK T1553.004 (Subvert Trust Controls: Install Root Certificate) and enables later use of T1649 (Steal or Forge Authentication Certificates).

Prerequisites for Exploitation

Two configuration conditions must both be true for the vulnerable code path to execute:

1. The smb.conf file on the domain member must contain apply group policies = yes.
2. Certificate auto-enrollment must be configured through the Windows Group Policy Management Editor (GPME).

If either condition is absent, the vulnerable code is never reached. Pure Samba domains do not implement Active Directory Certificate Services, so auto-enrollment is unavailable there through either LDAP or HTTP. Domain members are still vulnerable if the GPO is enabled.

Discovery

Arad Inbar, Nir Somech, and Ben Grinberg of the DREAM Security Research Team reported the vulnerability, along with Michalis Vasileiadis. The Red Hat Bugzilla entry (bug 2447319) was filed on 2026-03-13, and the embargo was lifted on 2026-05-27.

Patch Information

The Samba team released an upstream fix on May 26, 2026, written by Douglas Bagnall of Catalyst. The patch to python/samba/gp/gp_cert_auto_enroll_ext.py takes a clean, elimination-based approach. It removes the HTTP download code path entirely and makes the getca() function rely only on LDAP-sourced certificate data.

The patched getca() docstring now reads "Fetch a certificate from LDAP.", which matches what the function does. It processes only the cACertificate attribute that fetch_certification_authorities() has already retrieved over LDAP. It decodes the DER-encoded certificate, converts it to PEM format, and writes it to disk.

The patch also tightens endpoint URL handling in the __read_cep_data() method. The patched code recognizes two endpoint types: LDAP: endpoints, which query the directory directly, and HTTPS:// endpoints, which at least provide transport encryption. Any other URL scheme, including plain http://, now falls through to an error-logging branch and is rejected:

else:
    edata = { 'endpoint': ca['URL'] }
    log.error('Unrecognized endpoint', edata)

Before attempting enrollment, the patched code checks that the cACertificate attribute is present in the LDAP response. It logs a warning and skips any CA entry that lacks it.

Fixed Upstream Releases

Upstream patch files are available at https://www.samba.org/samba/security/:

• samba-4.24.2-security-2026-05-26.patch
• samba-4.23.7-security-2026-05-26.patch
• samba-4.22.9-security-2026-05-26.patch

The corresponding fixed releases are Samba 4.22.10, 4.23.8, and 4.24.3.

Distribution Patches

Detection Methods

Detecting exposure to CVE-2026-3012 takes several layers: configuration auditing, version checking, network traffic analysis, and trust store monitoring. As of the disclosure date, no formal automated detection signatures (such as YARA, Sigma, or Snort/Suricata rules) had been published for this vulnerability.

Configuration Auditing

Start by checking whether your environment enables the vulnerable code path. Two conditions must be true at the same time: the Samba smb.conf must contain apply group policies = yes, and certificate auto-enrollment must be configured through the Windows GPME. Auditing every domain member's smb.conf for this directive is a fast way to triage which systems are at risk. Red Hat notes that the vulnerable code is not exploitable in default RHEL configurations, since group policy processing requires an explicit administrative opt-in.

Version-Based Detection

All Samba versions from 4.16 onward are affected. Vulnerability scanners or asset inventories should flag any Samba installation in this range that has not been updated to 4.22.10, 4.23.8, or 4.24.3 (or the corresponding distribution-specific package versions listed above).

Network Traffic Indicators

The vulnerable behavior is that Samba domain members were fetching CA certificates from NDES endpoints over plain HTTP (TCP port 80). Flag as suspicious any Samba domain member that generates outbound HTTP traffic to NDES certificate enrollment URL paths. Domain members should never need the NDES HTTP path, because they already have access to certificates via LDAP. HTTP requests from Samba domain-joined Linux machines to Windows certificate enrollment infrastructure, found in firewall logs, proxy logs, or network flow data, are a strong detection signal, particularly when they go over port 80 where you would normally expect LDAP (port 389/636) traffic.

Trust Store Integrity Monitoring

A successful exploit would leave a rogue CA certificate in the domain member's local trust store. On Linux domain members, that means watching directories such as /etc/pki/tls/certs/, /usr/local/share/ca-certificates/, or distribution-specific trust paths. File integrity monitoring (FIM) tools or audit frameworks like auditd can be configured to track changes to these paths. Treat any CA certificate that does not match your organization's known PKI chain as a high-priority indicator of compromise.

Samba Log Review

Samba's log output (controlled by the log level directive in smb.conf) can show whether the auto-enrollment code path ran, if you review it for entries related to Group Policy processing and certificate enrollment. Look for log messages about GPO application, certificate retrieval, or HTTP connections to enrollment endpoints. Raising log verbosity temporarily during an investigation can help surface this activity.

Affected Systems and Versions

All Samba versions from 4.16 onward are vulnerable. The auto-enrollment code has trusted HTTP for CA certificate retrieval since the feature was introduced in 4.16.

Fixed upstream versions:

• Samba 4.22.10
• Samba 4.23.8
• Samba 4.24.3

Vulnerable configurations require both:

1. apply group policies = yes present in smb.conf
2. Certificate auto-enrollment configured via the Windows Group Policy Management Editor

Systems that do not meet both conditions do not execute the vulnerable code path. Pure Samba domains (without Active Directory Certificate Services) have reduced but non-zero risk, because domain members are still vulnerable if the GPO is enabled.

Vendor Security History

Samba has a well-documented history of security vulnerabilities going back more than two decades. Several past issues give useful context:

CVE-2017-7494 ("SambaCry") is a relevant precedent. Cryptocurrency mining botnets and ransomware operators exploited it at scale, which showed that Samba vulnerabilities can and do reach the exploitation stage when the network access requirements are achievable. CVE-2026-3012's adjacent-network requirement is a meaningful barrier in well-segmented environments. In flat networks, the conditions for exploitation are considerably easier to meet.

The Samba project runs a coordinated security release and disclosure process and typically issues patches for multiple supported branches at the same time.

References

• NVD: CVE-2026-3012
• Samba Security Announcement: CVE-2026-3012
• Samba Security Patch Archive
• Samba Source: gp_cert_auto_enroll_ext.py
• Red Hat CVE Page: CVE-2026-3012
• Red Hat Errata: RHSA-2026:3012
• Red Hat Bugzilla: Bug 2447319
• Samba Bugzilla: Bug 16003
• Ubuntu Security Notice: USN-8306-1
• Ubuntu CVE Tracker: CVE-2026-3012
• Debian Security Tracker: CVE-2026-3012
• SUSE CVE Page: CVE-2026-3012
• Amazon Linux CVE Page: CVE-2026-3012
• Samba Release Notes: 4.23.8
• Samba Security History
• SambaWiki: Certificate Auto Enrollment
• MITRE ATT&CK T1553.004: Install Root Certificate
• MITRE ATT&CK T1649: Steal or Forge Authentication Certificates
• VulnCheck: State of Exploitation 2026
• NVD: CVE-2017-7494 (SambaCry)
• Linux Compatible: Samba and Other Updates for Ubuntu