==================================================================
== Subject: Samba AD authenticated LDAP access domain takeover
==
== CVE ID#: CVE-2026-58221
==
== Versions: Samba AD DC versions 4.0.0 and later
==
== Summary: Samba AD low-privilege authenticated LDAP access
== allows modifications to internal LDB special DNs,
== which permits a domain takeover.
==================================================================
===========
Description
===========
Samba AD stores internal database configuration in LDB special records such as
@MODULES and @PARTITION. These records are not directory objects and should
never be writable by a normal LDAP client.
An authenticated low-privilege domain user can nevertheless modify them through
LDAP. The LDAP request is correctly marked as untrusted, but
`rootdse_filter_operations()` only rejects anonymous callers. The request then
reaches the DSDB ACL module, which intentionally skips ACL processing for
special DNs because it assumes only trusted internal callers can reach them.
This lets an ordinary user replace the DSDB module chain loaded for new LDAP
connections. By omitting only acl and aclread, the attacker gets a fully
functional LDAP connection without directory ACL enforcement and can add
themselves to protected administrator groups.
High-signal indicators:
- A recent modification timestamp of the main sam.ldb
most likely: /var/lib/samba/private/sam.ldb
- LDAP operations targeting DNs beginning with `@`;
- `@MODULES/@LIST` differing from `samba_dsdb`;
- unexpected `@PARTITION/modules` values on a standard provision;
- low-privilege accounts added to `Domain Admins`, `Enterprise Admins`, or
`Builtin Administrators`;
- Samba logs showing unusual module-load failures or module-stack changes.
If exploitation is suspected:
1. Stop Samba before editing internal LDB records offline.
2. Confirm `@MODULES/@LIST` is exactly `samba_dsdb`.
3. Remove unexpected `@PARTITION/modules` values offline if present.
4. Remove unauthorized protected-group memberships.
5. Audit privileged group, ACL, GPO/SYSVOL, service-account, and replication
changes made during the compromise window.
6. Rotate credentials according to the site's AD recovery plan, including
KRBTGT where appropriate.
==================
Patch Availability
==================
Patches addressing this issue have been posted to:
https://www.samba.org/samba/security/
Additionally, Samba 4.24.x, 4.23.x, and 4.22.x have been issued
as security releases to correct the defect. Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.
==================
CVSSv3 calculation
==================
CVSS:AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)
==========
Workaround
==========
There are no known workarounds for this vulnerability. Administrators are
advised to apply the security updates or patches as soon as possible.
In order to audit related changes and find the account that tries
the modifications, you can setup one or more log levels of:
dsdb_audit, dsdb_json_audit, dsdb_group_audit, dsdb_group_json_audit
See 'man smb.conf' for setup details.
=======
Credits
=======
Originally reported by OpenAI Security Research.
Patches provided by Stefan Metzmacher of the SerNet and the Samba team.
==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================