The vulnerability lies in Samba’s certificate auto‑enrollment mechanism, which retrieves a CA certificate over an unencrypted HTTP connection and installs it into the local trust store without performing any verification. This lack of validation allows an attacker who can intercept or redirect network traffic to supply a malicious CA certificate. If successful, the attacker could cause Samba to trust a rogue certificate authority, enabling the interception or spoofing of secure communications and undermining the integrity and confidentiality of traffic intended to be protected.

Affected systems include Red Hat Enterprise Linux releases 6, 7, 8, 9 and 10, as well as Red Hat OpenShift Container Platform 4. No specific Samba version numbers are disclosed in the advisory, so any installation of Samba on these platforms that processes group policy certificate enrollment is potentially susceptible.

The CVSS score of 8 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attacks would likely occur over the network by manipulating the HTTP path used by Samba during group policy processing, so the attack vector is network‑based. An adversary with the ability to redirect or replay HTTP requests between a Samba client and the certificate authority endpoint could supply a forged CA certificate and thereby pose as a trusted party.