SecuriTricks - CVE-2026-3012

Description

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Product(s) Impacted

Vendor	Product	Versions
Samba	Samba	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	samba	samba	/	/	/	/	/	/	/	/

References

https://access.redhat.com/security/cve/CVE-2026-3012

https://bugzilla.redhat.com/show_bug.cgi?id=2447319

https://bugzilla.samba.org/show_bug.cgi?id=16003

CVSS Score

8.0 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

View Vector String

Timeline

Published: May 27, 2026, 11:16 a.m.
Last Modified: May 27, 2026, 2:54 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-3012