CVE-2026-3012: Samba Certificate Auto-Enrollment Flaw

CVE-2026-3012 Overview

CVE-2026-3012 is a certificate validation flaw in Samba's Group Policy certificate auto-enrollment handling. When auto-enrollment is enabled, Samba retrieves a Certificate Authority (CA) certificate over an unencrypted HTTP connection. It then installs that certificate into the local trust store without verifying its authenticity. An attacker positioned to intercept or redirect adjacent network traffic can substitute a malicious CA certificate. Once installed, that attacker-controlled CA can be used to spoof trusted servers, issue forged certificates, and intercept TLS-protected communications across the affected host.

Critical Impact

A successful attack installs an attacker-controlled CA into the system trust store, enabling man-in-the-middle interception and spoofing of any TLS communication trusted by the host.

Affected Products

• Samba (certificate auto-enrollment Group Policy component)
• Red Hat Enterprise Linux distributions packaging affected Samba builds
• Any Linux distribution shipping Samba with auto-enrollment enabled

Discovery Timeline

• 2026-05-27 - CVE-2026-3012 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-3012

Vulnerability Analysis

The flaw resides in Samba's implementation of Active Directory certificate auto-enrollment policy. The auto-enrollment client fetches the CA certificate chain from the enrollment server using an unencrypted HTTP transport. Samba then writes the retrieved certificate directly into the local trust store. No signature verification, pinning, or out-of-band integrity check is performed before the trust decision occurs. The weakness maps to [CWE-345] (Insufficient Verification of Data Authenticity). An attacker who controls or observes traffic on the adjacent network can replace the legitimate CA certificate in transit. The substituted certificate is then trusted system-wide for any TLS validation that relies on the host trust store.

Root Cause

The root cause is the combination of two design choices in the auto-enrollment flow. First, the client uses cleartext HTTP rather than HTTPS or an authenticated channel for retrieving CA material. Second, the installation path treats whatever bytes arrive on the wire as authoritative trust anchors. The code lacks digital signature verification, certificate pinning, and policy validation against an already-trusted domain controller channel.

Attack Vector

Exploitation requires an adjacent network position, such as the same broadcast domain, a compromised router, or a hijacked DHCP or DNS service. The attacker waits for an auto-enrollment cycle or coerces one through Group Policy refresh. They then intercept the HTTP request for the CA certificate using ARP spoofing, rogue DHCP, DNS poisoning, or BGP/route manipulation. The attacker responds with a CA certificate they control. Samba installs the certificate, and from that point any TLS service whose certificate is signed by the attacker's CA appears legitimate to the host.

No verified public exploit code is available. Refer to the Samba Bugzilla Report #16003 and the Red Hat Security Advisory CVE-2026-3012 for technical details.

Detection Methods for CVE-2026-3012

Indicators of Compromise

• Unexpected CA certificates present in /etc/pki/ca-trust/source/anchors/ or the system NSS trust store on Samba-joined hosts.
• Outbound HTTP (port 80) requests from domain-joined Linux hosts to URLs containing CertEnroll, certsrv, or .crt paths.
• Group Policy auto-enrollment events in Samba logs referencing CA certificate downloads over non-HTTPS URLs.
• ARP table anomalies or duplicate MAC bindings for the gateway or domain controller on subnets running Samba clients.

Detection Strategies

• Inventory the system trust store on all Samba clients and baseline expected CA certificates, alerting on additions.
• Inspect network telemetry for cleartext HTTP traffic between Linux Samba clients and Active Directory Certificate Services endpoints.
• Correlate Group Policy refresh events with new certificate files written to trust store directories within a short time window.

Monitoring Recommendations

• Enable file integrity monitoring on /etc/pki/, /usr/share/pki/, and /etc/ssl/certs/ directories.
• Log and alert on invocations of update-ca-trust or update-ca-certificates outside of package management windows.
• Capture and review Samba samba-gpupdate and gpo debug logs for auto-enrollment activity and source URLs.

How to Mitigate CVE-2026-3012

Immediate Actions Required

• Disable certificate auto-enrollment Group Policy processing in Samba until patched builds are deployed.
• Audit the local trust store on every Samba-joined host and remove any CA certificate that cannot be attributed to an authorized internal CA.
• Restrict outbound HTTP from Linux clients to Active Directory Certificate Services hosts, forcing HTTPS where supported.

Patch Information

Apply vendor-supplied updates as they become available. Refer to the Red Hat Security Advisory CVE-2026-3012, the Red Hat Bugzilla Report #2447319, and the upstream Samba Bugzilla Report #16003 for fixed package versions and backports.

Workarounds

• Set the Samba gpo auto-enrollment extension to disabled via smb.conf or remove the auto-enrollment GPO from scope until patches are applied.
• Segment Samba clients onto trusted network segments with strong layer-2 controls such as DHCP snooping and dynamic ARP inspection to limit adjacent-network attacks.
• Pin or pre-provision the enterprise CA certificate out-of-band via configuration management so auto-enrollment retrieval is not the source of trust.

# Configuration example: disable Samba certificate auto-enrollment
# Edit /etc/samba/smb.conf and ensure auto-enrollment is excluded
# from Group Policy extensions, then refresh policy:

sudo samba-tool gpo list "$(hostname)"
sudo systemctl stop samba-gpupdate.service
sudo systemctl disable samba-gpupdate.service

# Audit and remove any unverified CA certificates
ls -l /etc/pki/ca-trust/source/anchors/
sudo trust list --filter=ca-anchors
# Remove suspicious anchor, then refresh trust store
sudo update-ca-trust extract