CVE-2026-58222

The vulnerability is a CWE-90 LDAP Injection flaw. Samba Active Directory Domain Controller fails to validate attribute names in LDAP Compare requests and then performs the resulting internal database search as a trusted user, bypassing normal ACL checks. This flaw allows an authenticated low‑privilege domain user to request comparison of arbitrary attributes and obtain the values of protected Active Directory attributes that should be inaccessible. If an attacker obtains attributes such as "msKds-RootKeyData" from a deployment that uses Group Managed Service Accounts, the data can be used to derive gMSA passwords offline and lead to complete domain compromise.

Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4 that run Samba Active Directory Domain Controller. No specific version information is supplied.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated low‑privilege domain user sending crafted LDAP Compare requests; if successful, the attacker can read sensitive attributes and potentially execute privilege escalation by deriving gMSA passwords.