This vulnerability arises from improper neutralization of special elements in LDAP queries within Samba AD DC on Red Hat Enterprise Linux 10. When processing LDAP Compare requests, Samba fails to validate user-supplied attribute names properly, executing internal database searches in a trusted context and bypassing ACL enforcement. An authenticated low-privilege user can exploit this to disclose confidential Active Directory attributes, including sensitive authentication material like the msKds-RootKeyData attribute used in gMSAs. Extracting this data can enable offline derivation of gMSA passwords, risking complete domain compromise if privileged gMSAs exist. The vulnerability is present in cloud-hosted services, with Red Hat responsible for patching.

An authenticated low-privilege domain user can bypass access controls to access confidential Active Directory attributes. This disclosure can lead to extraction of sensitive authentication data, such as gMSA passwords, enabling offline attacks that may escalate privileges and compromise the entire domain. The impact includes confidentiality, integrity, and availability consequences, rated high severity with a CVSS score of 8.8.

Red Hat manages remediation for this cloud-hosted service and has made a patch available. Users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-58222 for patch application instructions and ensure their systems are updated accordingly to mitigate this vulnerability.