CVE-2026-3012

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3012
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3012.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-3012
Downstream
Related
Published
2026-05-27T10:02:21.767Z
Modified
2026-06-11T04:01:33.534518411Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Samba: group policy certificate enrollment uses http:// without validation
Details

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3012.json",
    "cwe_ids": [
        "CWE-345"
    ],
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/samba-team/samba

Affected ranges

Type
GIT
Repo
https://github.com/samba-team/samba
Events
Introduced
e95d85f784ae6b19f2cb42cc9039b60b146e5b69
Fixed
1c7d4b5b388ae2647732ed54834d5547a8c1357a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.16.0"
        },
        {
            "fixed": "4.21.0"
        }
    ],
    "cpe": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3012.json"