8.0
High
CVE-2026-3012 Samba: group policy certificate enrollment uses http:// without validation
Description
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
CVSS 3.1 detail
Vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NExploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Adjacent network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | Versions not published | |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | Versions not published |
Show the 44 other branches Hide the 44 other branches
Other CVEs of Red Hat Enterprise Linux 10
The 1455 CVEs of Red Hat Enterprise Linux 10 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Medium
CVE-2026-120749
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
6.2
Medium
CVE-2026-123151
Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail
Not rated
CVE-2026-121997
Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch
8.1
High