CVE-2026-58222: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Red Hat Red Hat Enterprise Linux 10
CVE-2026-58222 is a high-severity vulnerability in Samba Active Directory Domain Controller on Red Hat Enterprise Linux 10. It involves LDAP injection combined with improper authorization checks during LDAP Compare requests. This flaw allows authenticated low-privilege domain users to bypass normal access controls and disclose confidential Active Directory attributes. Sensitive information such as Group Managed Service Account (gMSA) passwords can be extracted, potentially leading to privilege escalation and full domain compromise. The vulnerability has a CVSS score of 8.8 and affects cloud-hosted services where Red Hat manages remediation.
AI Analysis
Technical Summary
This vulnerability arises from improper neutralization of special elements in LDAP queries within Samba AD DC on Red Hat Enterprise Linux 10. When processing LDAP Compare requests, Samba fails to validate user-supplied attribute names properly, executing internal database searches in a trusted context and bypassing ACL enforcement. An authenticated low-privilege user can exploit this to disclose confidential Active Directory attributes, including sensitive authentication material like the msKds-RootKeyData attribute used in gMSAs. Extracting this data can enable offline derivation of gMSA passwords, risking complete domain compromise if privileged gMSAs exist. The vulnerability is present in cloud-hosted services, with Red Hat responsible for patching.
Potential Impact
An authenticated low-privilege domain user can bypass access controls to access confidential Active Directory attributes. This disclosure can lead to extraction of sensitive authentication data, such as gMSA passwords, enabling offline attacks that may escalate privileges and compromise the entire domain. The impact includes confidentiality, integrity, and availability consequences, rated high severity with a CVSS score of 8.8.
Mitigation Recommendations
Red Hat manages remediation for this cloud-hosted service and has made a patch available. Users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58222 for patch application instructions and ensure their systems are updated accordingly to mitigate this vulnerability.
CVE-2026-58222: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Red Hat Red Hat Enterprise Linux 10
Description
CVE-2026-58222 is a high-severity vulnerability in Samba Active Directory Domain Controller on Red Hat Enterprise Linux 10. It involves LDAP injection combined with improper authorization checks during LDAP Compare requests. This flaw allows authenticated low-privilege domain users to bypass normal access controls and disclose confidential Active Directory attributes. Sensitive information such as Group Managed Service Account (gMSA) passwords can be extracted, potentially leading to privilege escalation and full domain compromise. The vulnerability has a CVSS score of 8.8 and affects cloud-hosted services where Red Hat manages remediation.
CVSS v3.1
Score 8.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper neutralization of special elements in LDAP queries within Samba AD DC on Red Hat Enterprise Linux 10. When processing LDAP Compare requests, Samba fails to validate user-supplied attribute names properly, executing internal database searches in a trusted context and bypassing ACL enforcement. An authenticated low-privilege user can exploit this to disclose confidential Active Directory attributes, including sensitive authentication material like the msKds-RootKeyData attribute used in gMSAs. Extracting this data can enable offline derivation of gMSA passwords, risking complete domain compromise if privileged gMSAs exist. The vulnerability is present in cloud-hosted services, with Red Hat responsible for patching.
Potential Impact
An authenticated low-privilege domain user can bypass access controls to access confidential Active Directory attributes. This disclosure can lead to extraction of sensitive authentication data, such as gMSA passwords, enabling offline attacks that may escalate privileges and compromise the entire domain. The impact includes confidentiality, integrity, and availability consequences, rated high severity with a CVSS score of 8.8.
Mitigation Recommendations
Red Hat manages remediation for this cloud-hosted service and has made a patch available. Users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58222 for patch application instructions and ensure their systems are updated accordingly to mitigate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-06-29T18:18:00.439Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-58222","vendor":"Red Hat"}]
Threat ID: 6a6b816b9c2644c7f860ebc5
Added to database: 07/30/2026, 16:52:59 UTC
Last enriched: 07/30/2026, 17:07:57 UTC
Last updated: 07/30/2026, 17:27:56 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.