CVE-2026-58222.html:

==========================================================================
== Subject:     Samba AD LDAP Compare filter injection and trusted-request
==              confusion disclose protected attributes
==
== CVE ID#:     CVE-2026-58222
==
== Versions:    Samba AD DC versions 4.0.0 and later
==
== Summary:     An ordinary authenticated domain user can bypass access
==              checks and query confidential Active Directory attributes
==              (such as KDS root keys) via LDAP Compare requests. Due to
==              a filter injection flaw and trusted execution context, the
==              LDAP Compare operation can be turned into a
==              protected-attribute disclosure oracle.
==========================================================================

===========
Description
===========

Samba's LDAP CompareRequest path contains two independent security flaws that
can be combined by an authenticated attacker to construct a reliable oracle for
protected (confidential) Active Directory attributes.

1. Filter Injection Flaw
When processing an LDAP Compare request, Samba constructs a textual LDB filter
by directly formatting the user-provided attribute name and assertion value
into a search filter string using talloc_asprintf():

    filter = talloc_asprintf(local_ctx, "(%s=%*s)", req->attribute,
                             (int)req->value.length, req->value.data);

This formulation is unsafe because:
- The attribute name is not validated as a valid LDAP AttributeDescription.
- The assertion value is not escaped.
- The field format (%*s) does not properly handle binary or BER-encoded bytes.

By providing an attribute name containing filter operators (for example,
appending ">=" to the attribute name), an attacker can coerce Samba into
evaluating a comparison operator other than equality.

2. Trusted Search Context Flaw
Samba evaluates the generated filter using an internal local LDB search request
without marking it as untrusted. Normal LDAP search requests enforce access
controls by marking requests from unprivileged connections as untrusted. The
ACL read module uses this marker to determine whether it must enforce visibility
checks. Because Compare requests do not mark the database search as untrusted,
they are evaluated with trusted system-level visibility, bypassing standard ACL
checks for confidential attributes.

Combining these two flaws, an ordinary authenticated domain user can issue
ordered true/false Compare queries (e.g. using inequality operators like ">=") to
binary-search and reconstruct binary values of confidential attributes that are
normally redacted from LDAP Search results.

A key target for this attack is the msKds-RootKeyData attribute, which contains
the root secret for the Group Key Distribution Service (GKDI). On Samba AD DC
installations supporting Group Managed Service Accounts (gMSAs) (Samba 4.21.0
and later), an attacker can extract this key and derive the passwords of gMSAs
offline. If a privileged gMSA exists, this allows full domain compromise.

==================
Patch Availability
==================

Patches addressing this issue have been posted to:

    https://www.samba.org/samba/security/

Additionally, Samba 4.24.x, 4.23.x, and 4.22.x have been issued
as security releases to correct the defect.  Samba administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)

Severity is High for generic protected-attribute disclosure, and Critical
when disclosed KDS roots are used to compromise privileged gMSAs.

==========
Workaround
==========

There are no known workarounds for this vulnerability. Administrators are
advised to apply the security updates or patches as soon as possible.

=======
Credits
=======

Originally reported by OpenAI Security Research.

Underlying bugs also reported by Andrew Tridgell of the Samba Team and
Tristan Madani of Talence Security.

Patches provided by Stefan Metzmacher of the SerNet and the Samba team.

==========================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
==========================================================