OpenAI report: Samba's LDAP CompareRequest path converts attacker-controlled BER fields into a textual LDB filter and evaluates it as a trusted local DSDB search. A normal domain user can inject an ordered comparison operator into the AttributeDescription and use the Compare true/false result as an oracle over protected attributes. The supplied exploit recovers a 64-byte msKds-RootKeyData value in 517 Compare requests. On Samba builds with gMSA/KDS managed-password support, the recovered root key can be used to derive privileged gMSA credentials offline. The Compare oracle was validated against Samba 4.25.0pre1-GIT-2fc21d87fc8 and Ubuntu 24.04 Samba 4.19.5+dfsg-4ubuntu9.6. In the 4.19 package test, a KDS root-key object was created before testing the oracle; the full KDS-root-to- privileged-gMSA credential chain was validated only on the 4.25 source build. The proposed fix validates the Compare AttributeDescription, builds an explicit equality parse tree from the BER assertion bytes, and marks non-privileged LDAP Compare requests untrusted before DSDB evaluation. The report includes the vulnerable filter construction, the normal Search untrusted-marker path, and the ACL-read trust check that makes the oracle possible.
Created attachment 19027 [details] original report
Created attachment 19028 [details] OpenAI proposed patch
Created attachment 19031 [details] more report
Created attachment 19034 [details] security-bug-16148-master-metze-01.patches.txt This also fixes the problem for me
Created attachment 19055 [details] CVE-2026-58222-advisory-v1.txt
Created attachment 19064 [details] patch for master v2 master patch applies back to 4.21.
Also reported by Tristan Mandani, 2026-06-27: LDAP CompareRequest Missing ldb_req_mark_untrusted Allows ACL Bypass ==================================================================== CVSS 3.1: 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) CWE: CWE-863 (Incorrect Authorization) Auth: Authenticated LDAP user Version: Samba 4.24.3 AD DC mode, master HEAD File: source4/ldap_server/ldap_backend.c, ldapsrv_CompareRequest(), line 1469 Root Cause: The LDB search request used to implement the LDAP Compare operation is missing the ldb_req_mark_untrusted() call. Every other LDAP operation handler (Search, Add, Modify, Delete, ModifyDN) marks its LDB request as untrusted, which enables ACL enforcement in the acl LDB module. Without this marking, Compare runs with elevated privileges. // ldapsrv_CompareRequest - MISSING mark_untrusted ldb_ret = ldb_search(samdb, local_ctx, &res, dn, LDB_SCOPE_BASE, attrs, "%s", filter); // Uses ldb_search() convenience wrapper - no untrusted flag // ldapsrv_SearchRequest - CORRECT pattern ldb_ret = ldb_build_search_req_ex(...); ldb_req_mark_untrusted(lreq); // enables ACL enforcement Data Flow: Authenticated LDAP user sends Compare request for a DN + attribute -> ldapsrv_CompareRequest() builds LDB search without untrusted flag -> acl LDB module checks untrusted flag to enforce ACLs -> flag not set -> operation runs as trusted (internal) -> Compare response (TRUE/FALSE) reveals attribute values -> attacker can test protected attributes: unicodePwd, LAPS passwords Impact: Authenticated LDAP users can use Compare requests as an oracle to test attribute values on objects they should not have read access to. This enables enumeration of password hashes (unicodePwd), LAPS admin passwords (ms-Mcs-AdmPwd), and confidential attributes. The Compare TRUE/FALSE response enables binary search for values. Lab verified: code trace confirmed missing ldb_req_mark_untrusted() vs all 5 other LDAP operation handlers.
Tristan Mandani also reports the other half of this, thus: LDAP Compare Request Filter Injection via Unescaped Value ========================================================= CVSS 3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CWE: CWE-90 (LDAP Injection) Auth: Authenticated LDAP user Version: Samba 4.24.3 and prior, master (2026-06-25) File: source4/ldap_server/ldap_backend.c, ldapsrv_CompareRequest(), line 1469 Root Cause: The LDAP Compare operation constructs a search filter by interpolating the comparison value directly into the filter string without escaping LDAP metacharacters. Other LDAP operations (e.g., Bind) properly use ldb_binary_encode_string(). Characters like *, (, ), and \ pass through unescaped, allowing filter injection. // ldap_backend.c:1469 - VULNERABLE filter = talloc_asprintf(local_ctx, "(%s=%*s)", req->attribute, (int)req->value.length, req->value.data); // NOT escaped // ldap_bind.c:462 - CORRECT pattern encoded = ldb_binary_encode_string(tmp_ctx, dn); Data Flow: Client sends Compare request with value ")(uid=admin)" -> filter becomes "(attr=)(uid=admin))" - injected filter syntax -> ldb_search() evaluates the compound filter -> Compare TRUE/FALSE response leaks info about injected filter Impact: Authenticated LDAP users can inject filter syntax to perform wildcard searches or compound filter evaluations through the Compare response oracle. By observing TRUE/FALSE responses, attribute values of other entries -- including userPassword hashes, supplementalCredentials (NTLM/Kerberos keys), and SID values -- can be extracted character by character using boolean-based enumeration, analogous to blind SQL injection. Full credential extraction is achievable with automated binary search over the Compare oracle. Lab verified: code trace confirmed missing ldb_binary_encode_string().
*** Bug 16122 has been marked as a duplicate of this bug. ***
Created attachment 19097 [details] advisory v2 (adds Tridge/Tristan credit)
(In reply to Douglas Bagnall from comment #10) Thanks Douglas!
adding vendors here. scheduled release 2026-07-28 10:00 UTC.
Also reported by Bin Luo of University of Electronic Science and Technology of China (UESTC). Unfortunately this report arrived too late to make it into the official advisory.
This bug was referenced in samba v4-23-stable (Release samba-4.23.10): 3ba20d57ef739706a7f5fd1b22a21ec2de95e226
This bug was referenced in samba v4-24-stable (Release samba-4.24.5): 781ee8cce74af9d7c5627ba0035eb43a1aa7a2e3
This bug was referenced in samba v4-22-stable (Release samba-4.22.11): b81cb925d8712f31832c174e7d4f22e350600b3c
This bug was referenced in samba v4-22-test: b81cb925d8712f31832c174e7d4f22e350600b3c
This bug was referenced in samba v4-24-test: 18a2cf6f3cb16ad7aee3f2ce8241cda70247aa4a
This bug was referenced in samba v4-23-test: f393bce0544ff8357944ea4c76588d83306484db
This bug was referenced in samba v4-24-test: 781ee8cce74af9d7c5627ba0035eb43a1aa7a2e3
This bug was referenced in samba v4-23-test: 3ba20d57ef739706a7f5fd1b22a21ec2de95e226
This bug was referenced in samba master: 07786681889b972b2b78ccb854f23443e57cb87c
This bug was referenced in samba v4-23-stable (Release samba-4.23.11): f393bce0544ff8357944ea4c76588d83306484db
This bug was referenced in samba v4-24-stable (Release samba-4.24.6): 18a2cf6f3cb16ad7aee3f2ce8241cda70247aa4a