CVE-2026-4408: Samba: remote code execution in samr
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Other sources
Remote Code Execution in SAMR when check password script contains %u substitution placeholder
— Debian
Samba file servers and classic (non-AD) domain controllers offer the SamValidatePasswordChange and SamValidatePasswordReset RPC services on the SAMR DCE/RPC service when running over NCACNIPTCP. Both services pass a username and password to the "check password script" that can be configured in smb.conf.
If the "check password script" is configured with the %u substitution character, the client-controlled username is passed to the "check password script" without escaping shell meta-characters, leading to a remote command execution vulnerability.
This is a non-standard configuration in several ways:
It affects Samba file servers and classic (non-AD) domain controllers that have the "check password script" configured with the %u substitution character. Active Directory Domain Controllers are not affected, they do not expand the username via the %u substitution character.
The problem is much less dangerous if %u has single quotes directly around it, e.g. '%u', but it's still possible to inject command line options.
Standard Samba file servers and classic domain controllers are also only affected if the samba-dcerpcd service is started as a system service, which can only happen if "rpc start on demand helpers" is set to the non-default setting "no". In the default configuration for DCE/RPC, smbd starts the samba-dcerpcd in a way that makes the vulnerable code inaccessible.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.17.12+dfsg-0+deb12u4Fixed in 2:4.22.8+dfsg-0+deb13u2Fixed in 2:4.24.3+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4408?
The severity of CVE-2026-4408 is critical, with a score of 9.8.
What is CVE-2026-4408 about?
CVE-2026-4408 is a flaw in Samba that allows remote code execution via misconfiguration of the 'check password script' feature.
How do I fix CVE-2026-4408?
To fix CVE-2026-4408, ensure that the 'check password script' feature is configured correctly and does not use the %u placeholder.
What systems are affected by CVE-2026-4408?
CVE-2026-4408 affects Samba installations on Red Hat Enterprise Linux, Debian/Samba, and Red Hat OpenShift Container Platform.
What type of vulnerability is CVE-2026-4408?
CVE-2026-4408 is classified as an OS Command Injection vulnerability.