CVE-2026-12249: Canonical ADSys Information Disclosure Flaw

CVE-2026-12249 Overview

CVE-2026-12249 is a certificate validation flaw in Canonical ADSys versions through v0.16.2. The vendored Samba client script gp_cert_auto_enroll_ext.py retrieves the Active Directory Certificate Services (AD CS) Root CA certificate over plaintext HTTP instead of HTTPS during auto-enrollment. A network attacker positioned between the managed Ubuntu host and the AD CS server can intercept the GetCACert request and return an attacker-controlled Root CA. ADSys then installs this rogue certificate into the system trust store via update-ca-certificates, poisoning TLS validation system-wide. The issue is fixed in v0.16.3 [CWE-348].

Critical Impact
System-wide trust store poisoning enables persistent decryption and interception of TLS connections for arbitrary domains on the affected Ubuntu host.

Affected Products

Canonical ADSys upstream versions through v0.16.2
Ubuntu hosts using ADSys for Active Directory Group Policy management
Managed endpoints performing AD CS certificate auto-enrollment

Discovery Timeline

2026-06-22 - CVE-2026-12249 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12249

Vulnerability Analysis

ADSys integrates a vendored copy of Samba's Group Policy certificate auto-enrollment logic to register Ubuntu hosts with Active Directory Certificate Services. During enrollment, the client requests the Root CA chain from the configured AD CS host using the mscep.dll/pkiclient.exe endpoint. The vulnerable code constructs this URL with the http:// scheme, transmitting the request and response in plaintext across the network.

Because the response contains the Root CA used to seed the local trust anchors, integrity of that channel is essential. ADSys does not validate the origin or signature of the returned certificate independently. After retrieval, the certificate is written into the global trust directory and committed via update-ca-certificates, granting it authority equivalent to any pre-installed Root CA. Every TLS client on the host that consults the OS trust store, including curl, apt, package managers, and system services, will accept certificates signed by the attacker.

Root Cause

The root cause is the use of an unauthenticated, unencrypted transport for certificate distribution. The code in internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py hardcoded http:// for the CA retrieval URL. This violates the trust assumption that Root CA material must be obtained over an authenticated channel [CWE-348: Use of Less Trusted Source].

Attack Vector

An unauthenticated attacker on the network path between the Ubuntu host and the AD CS hostname intercepts the plaintext GetCACert HTTP request. The attacker responds with a Root CA they control. ADSys installs the certificate without further validation. The attacker can then issue forged leaf certificates for any domain and intercept subsequent TLS traffic from the compromised host, achieving persistent Man-in-the-Middle access.

python

 def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'):
     """Install the root certificate chain."""
     data = dict({'files': [], 'templates': []}, **ca)
-    url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname']
 
     log.info("Try to get root or server certificates")
-
+    url = 'https://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname']
     root_certs = getca(ca, url, trust_dir)
+
     data['files'].extend(root_certs)
     global_trust_dir = find_global_trust_dir()
     for src in root_certs:

Source: GitHub Commit 8b1939f9. The patch replaces the http:// scheme with https://, forcing TLS for the CA retrieval request.

Detection Methods for CVE-2026-12249

Indicators of Compromise

Unexpected Root CA certificates appearing under /usr/local/share/ca-certificates/ or /etc/ssl/certs/ on ADSys-managed hosts.
Outbound plaintext HTTP requests to mscep.dll/pkiclient.exe endpoints captured in network telemetry.
Recent entries in update-ca-certificates logs referencing certificates not issued by the expected enterprise CA.

Detection Strategies

Inventory the system trust store on every ADSys-managed Ubuntu host and compare installed Root CAs against an approved baseline.
Inspect network flow logs for HTTP traffic on TCP/80 originating from Ubuntu endpoints toward AD CS server hostnames.
Audit ADSys versions across the fleet and flag any host running v0.16.2 or earlier.

Monitoring Recommendations

Forward /var/log/syslog and update-ca-certificates events to a centralized log platform for correlation against enrollment activity.
Alert on additions to /etc/ssl/certs/ca-certificates.crt outside change windows.
Monitor DNS resolution patterns and ARP tables on the management network for signs of MITM positioning.

How to Mitigate CVE-2026-12249

Immediate Actions Required

Upgrade ADSys to v0.16.3 or later on all managed Ubuntu hosts.
Review the system trust store and remove any Root CA certificates that cannot be attributed to a legitimate enrollment event.
Rotate any TLS certificates and credentials that may have been exposed through intercepted sessions on affected hosts.

Patch Information

The fix is committed in GitHub Commit 8b1939f9 and shipped in ADSys v0.16.3. Refer to the Ubuntu Security Advisory CVE-2026-12249 for distribution-specific package versions and update guidance.

Workarounds

Restrict AD CS auto-enrollment traffic to a trusted, segmented management network until patches are deployed.
Block outbound TCP/80 to AD CS server hostnames at the host or network firewall, allowing only TCP/443.
Disable ADSys certificate auto-enrollment policy temporarily where v0.16.3 cannot be installed.

bash

# Verify installed ADSys version
dpkg -l adsys | awk '/^ii/ {print $3}'

# Upgrade to the patched release
sudo apt update && sudo apt install --only-upgrade adsys

# Audit Root CA trust store entries
ls -l /usr/local/share/ca-certificates/
awk -v cmd='openssl x509 -noout -subject -issuer' '/BEGIN/{close(cmd)};{print | cmd}' /etc/ssl/certs/ca-certificates.crt