CVE-2026-4408

Published May 28, 2026

Last updated 13 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-4408 describes a flaw found in Samba, specifically impacting Samba file servers and classic domain controllers that utilize the "check password script" feature. The vulnerability arises when this script is configured to use the `%u` substitution character, which passes a client-controlled username without proper escaping of shell meta-characters. This misconfiguration allows a remote attacker to achieve remote command execution on the affected system. The issue primarily affects non-standard configurations where the "check password script" is employed with `%u` and the `samba-dcerpcd` service is running as a system service.

Description: A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Source: secalert@redhat.com
NVD status: Undergoing Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secalert@redhat.com: CWE-78

Hype score: Not currently trending

References