CVE-2026-44053: Netatalk DHCAST128 Crypto Vulnerability

CVE-2026-44053 Overview

CVE-2026-44053 affects Netatalk versions 1.5.0 through 4.2.2. The vulnerability resides in the DHCAST128 User Authentication Module (UAM), which implements a broken cryptographic algorithm. A remote attacker can perform a cryptanalytic attack against the authentication exchange to recover credentials or impersonate a legitimate user. Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) widely deployed on Linux and BSD systems to provide file sharing services for macOS clients. The flaw is classified under [CWE-327] (Use of a Broken or Risky Cryptographic Algorithm) and impacts the confidentiality and integrity of authenticated AFP sessions.

Critical Impact
Remote attackers can recover authentication credentials or impersonate users on Netatalk AFP servers by exploiting weak cryptography in the DHCAST128 UAM.

Affected Products

Netatalk 1.5.0 through 4.2.2
DHCAST128 UAM authentication module
AFP file shares relying on DHCAST128 for user authentication

Discovery Timeline

2026-05-21 - CVE CVE-2026-44053 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-44053

Vulnerability Analysis

The DHCAST128 UAM is one of several authentication mechanisms supported by Netatalk for AFP clients. It performs a Diffie-Hellman key exchange followed by CAST-128 encryption of the user password. The implementation relies on cryptographic primitives and parameters that no longer provide adequate security against modern cryptanalysis. An attacker positioned to observe or actively interact with the authentication handshake can mount a cryptanalytic attack to recover the shared secret or the user password.

Once credentials are recovered, the attacker authenticates to the AFP service as the targeted user. This grants access to files, directories, and any resources the user is authorized to reach. The attack does not require prior privileges or user interaction, although the cryptanalysis itself raises attack complexity.

Root Cause

The root cause is the continued use of weak cryptographic parameters in the DHCAST128 UAM. Both the key-agreement parameters and the symmetric cipher choice fail to meet current security expectations. The module was designed for compatibility with classic Mac OS clients and was never hardened against contemporary cryptanalytic capabilities.

Attack Vector

The attack vector is network-based. An attacker who can reach the AFP service or observe authentication traffic can collect the handshake material needed for cryptanalysis. Successful exploitation yields valid credentials or a hijacked authenticated session. See the Netatalk Security Advisory for protocol-level technical details.

No verified proof-of-concept code is publicly available.
Refer to the Netatalk Security Advisory for protocol specifics.

Detection Methods for CVE-2026-44053

Indicators of Compromise

Unexpected successful AFP logins from unfamiliar source addresses to TCP port 548
Repeated authentication attempts negotiating the DHCAST128 UAM rather than stronger UAMs
Anomalous file access patterns on AFP shares immediately following authentication events

Detection Strategies

Inspect afpd logs for authentication events using the DHCAST128 UAM and correlate with source IP reputation
Alert on AFP sessions that originate outside expected client subnets or VPN ranges
Compare authenticated user activity against typical baselines to surface impersonation

Monitoring Recommendations

Forward Netatalk logs to a centralized log platform and retain authentication records for forensic review
Monitor network flows to TCP/548 and flag connections from untrusted segments
Track UAM negotiation outcomes to identify clients still requesting deprecated authentication modules

How to Mitigate CVE-2026-44053

Immediate Actions Required

Upgrade Netatalk to a fixed release as documented in the Netatalk Security Advisory
Disable the DHCAST128 UAM in afp.conf and require stronger authentication mechanisms
Restrict AFP service exposure to trusted network segments and authenticated VPN users
Rotate credentials for any account that authenticated against an affected server

Patch Information

The Netatalk project has published fix guidance in its security advisory. Administrators should review the advisory, apply the recommended package update for their distribution, and restart the netatalk or afpd service after upgrading.

Workarounds

Remove uams_dhx.so from the configured UAM list and use a stronger UAM where supported
Place AFP services behind a firewall that restricts access to known client networks
Migrate file sharing for macOS clients to SMB where DHCAST128 cannot be disabled without breaking compatibility

bash

# /etc/netatalk/afp.conf - example UAM hardening
[Global]
  uam list = uams_gss.so uams_clrtxt.so
  # Remove uams_dhx.so (DHCAST128) and uams_dhx2.so if not required
  # Restart service after editing:
  #   systemctl restart netatalk