CVE-2026-58221

samba: authenticated LDAP access to internal LDB special DNs permits domain takeover

Published n/a CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Description

A flaw was found in Samba Active Directory Domain Controller (AD DC). Improper authorization checks allow an authenticated low-privilege domain user to modify internal LDB special records through LDAP. By altering the DSDB module configuration, an attacker can bypass directory ACL enforcement on new LDAP connections and elevate privileges, potentially leading to complete domain compromise.

Analysis

Technical impact

This flaw allows a low‑privilege domain user to modify internal LDB special records through LDAP, altering the DSDB module configuration and bypassing ACL enforcement for new LDAP connections. The result is an elevation of privileges that can culminate in a complete domain takeover. The weakness centers on authentication and access control (CWE‑284).

Affected Systems

All Samba Active Directory Domain Controller installations are potentially vulnerable. The specific affected versions are not disclosed in the publicly available data, so any Samba AD DC that has not applied the latest patch should be considered at risk.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is classified as high severity. Exploitation requires only authentication as a low‑privilege domain user, making the attack vector relatively straightforward for insiders or compromised accounts. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS score and the ability to bypass ACLs indicates a significant risk if left unpatched.

Affected Products

No data.

Vendor Product Versions

Samba

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Samba AD DC to the latest stable release that contains the CVE‑2026‑58221 fix.
If an immediate patch is unavailable, restrict modify permissions on internal LDB special DNs for low‑privilege users to prevent unauthorized changes.
Verify that LDAP ACLs enforce proper authentication and access control on all domain objects, and audit DSDB module configuration settings for unauthorized alterations.

Generated by OpenCVE AI on August 2, 2026 at 02:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6401-1	samba security update
Ubuntu USN	USN-8621-1	Samba vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://bugzilla.samba.org/show_bug.cgi?id=16147
https://nvd.nist.gov/vuln/detail/CVE-2026-58221
https://www.cve.org/CVERecord?id=CVE-2026-58221
https://www.samba.org/samba/security/CVE-2026-58221.html

History

Jul 31, 2026 2:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Samba Samba samba
Vendors & Products		Samba Samba samba

Jul 31, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in Samba Active Directory Domain Controller (AD DC). Improper authorization checks allow an authenticated low-privilege domain user to modify internal LDB special records through LDAP. By altering the DSDB module configuration, an attacker can bypass directory ACL enforcement on new LDAP connections and elevate privileges, potentially leading to complete domain compromise.
Title		samba: authenticated LDAP access to internal LDB special DNs permits domain takeover
Weaknesses		CWE-284
References		https://bugzilla.samba.org/show_bug.cgi?id=16147 https://nvd.nist.gov/vuln/detail/CVE-2026-58221 https://www.cve.org/CVERecord?id=CVE-2026-58221 https://www.samba.org/samba/security/CVE-2026-58221.html
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`