The vulnerability lies in Samba’s certificate auto‑enrollment mechanism, which retrieves a CA certificate over an unencrypted HTTP connection and installs it into the local trust store without performing any verification. This lack of validation allows an attacker who can intercept or redirect network traffic to supply a malicious CA certificate. If successful, the attacker could cause Samba to trust a rogue certificate authority, enabling the interception or spoofing of secure communications and undermining the integrity and confidentiality of traffic intended to be protected. The flaw also maps to CWE‑345.

Affected systems include Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4.

The CVSS score of 8 indicates high severity, while the EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attacks would likely occur over the network by manipulating the HTTP path used by Samba during group policy processing, so the attack vector is network‑based. An adversary with the ability to redirect or replay HTTP requests between a Samba client and the certificate authority endpoint could supply a forged CA certificate and thereby pose as a trusted party.