CVE-2026-44058: Netatalk Auth Bypass Vulnerability

CVE-2026-44058 Overview

CVE-2026-44058 is an authentication bypass vulnerability in Netatalk, the open source implementation of the Apple Filing Protocol (AFP). The flaw affects Netatalk versions 2.2.2 through 4.4.2 and resides in the admin auth user mechanism. A remote authenticated user with privileged access can leverage the flaw to authenticate as any arbitrary user on the server. This breaks the trust boundary that the admin auth user feature is supposed to enforce and enables full impersonation of file share users [CWE-287].

Critical Impact

A privileged remote attacker can authenticate as arbitrary users, gaining full read, write, and modify access to their AFP shares.

Affected Products

• Netatalk 2.2.2 through 2.x
• Netatalk 3.x releases up to 3.x final
• Netatalk 4.0.0 through 4.4.2

Discovery Timeline

• 2026-05-21 - CVE-2026-44058 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-44058

Vulnerability Analysis

Netatalk provides AFP file services to macOS clients on Unix and Linux servers. The admin auth user directive lets an administrator designate a specific account that can authenticate to the AFP server and then act on behalf of other users. This is intended as a controlled administrative delegation mechanism.

The vulnerability allows a remote, authenticated user holding the admin auth role to bypass the intended verification step and authenticate as any arbitrary user. The attack is performed over the network through the standard AFP authentication flow. No user interaction is required on the target system.

Successful exploitation yields complete confidentiality, integrity, and availability impact within the AFP service context. The attacker can read sensitive files, modify or destroy data, and disrupt service for impersonated users.

Root Cause

The root cause is improper authentication [CWE-287] in the admin auth user code path. The server fails to correctly restrict the privileged delegation primitive, treating attacker-supplied identity claims as authoritative without sufficient validation. This is a logic flaw in privilege handling rather than a memory corruption issue.

Attack Vector

The attack vector is network based and requires the attacker to already possess high privileges, specifically the credentials of the configured admin auth user account. From that position, the attacker issues AFP authentication requests that specify a target username. The server accepts the impersonation request and grants a session as the targeted account.

No verified public proof-of-concept code is available at the time of writing. See the Netatalk Security Advisory CVE-2026-44058 for vendor technical details.

Detection Methods for CVE-2026-44058

Indicators of Compromise

• AFP authentication sessions originating from the admin auth user account that subsequently operate as other unrelated user identities within a short time window.
• Unexpected file access patterns in user home directories or shares performed by sessions tied back to the admin auth user role.
• Netatalk afpd log entries showing repeated authentications from a single source IP cycling through multiple target usernames.

Detection Strategies

• Audit afpd.conf and AppleVolumes.default for any configured admin auth user directive and confirm whether the role is actually required.
• Correlate AFP authentication logs with downstream file access events to identify identity switches that do not match normal administrative workflows.
• Alert on any AFP login as a service or system account that should never authenticate interactively over AFP.

Monitoring Recommendations

• Forward afpd and cnid_metad logs to a central SIEM and retain at least 90 days of authentication history.
• Monitor network flows to TCP port 548 from unexpected source ranges, especially from outside the management network.
• Track changes to Netatalk configuration files using file integrity monitoring on /etc/netatalk/ or the distribution-specific path.

How to Mitigate CVE-2026-44058

Immediate Actions Required

• Upgrade Netatalk to a fixed release published after version 4.4.2 as listed in the vendor advisory.
• Remove or disable the admin auth user directive in afpd.conf until the server is patched.
• Rotate the password of any account currently configured as the admin auth user and review its recent session activity.
• Restrict AFP service exposure to trusted management networks using host firewalls or network ACLs.

Patch Information

The Netatalk project has published guidance and fixed builds in the Netatalk Security Advisory CVE-2026-44058. Administrators should apply the vendor-supplied patched release for their branch and restart the afpd service after upgrade. Distribution maintainers for Debian, Ubuntu, Fedora, and FreeBSD ports typically ship backported fixes shortly after upstream publication.

Workarounds

• Disable the admin auth user feature by removing the admin auth user option from the Netatalk configuration and reloading the service.
• Limit AFP exposure by binding afpd to internal interfaces only and blocking TCP 548 at the perimeter.
• Migrate clients to SMB where feasible and stop the Netatalk service on hosts that no longer require AFP.

# Example: disable admin auth user and restrict afpd to internal interface
# /etc/netatalk/afp.conf
[Global]
# admin auth user = backupadmin   # comment out until patched
afp listen = 10.0.0.5
afp port = 548

# Reload the service
sudo systemctl restart netatalk