--- id: CVE-2026-3012 title: A flaw was found in Samba’s certificate auto-enrollment Group Policy handling summary: >- A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store… severity: high cvss: 8 cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N' cwe: - CWE-345 vendor: redhat product: openshift_container_platform affected: - openshift_container_platform = 4.0 - 'samba >= 4.16.0, < 4.21.0' - enterprise_linux = 7.0 - enterprise_linux = 9.0 patched: - samba 4.21.0 published: '2026-05-27' updated: '2026-09-18' sourceUpdated: '2026-09-18T13:18:14.087' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-3012' references: - url: 'https://access.redhat.com/errata/RHSA-2026:22644' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:22963' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:25049' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:25979' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28053' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28054' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28055' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28056' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:28057' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:29863' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:56786' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:56853' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:56911' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:57483' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:59831' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:60019' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:62409' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:62549' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65839' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65851' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:65907' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-3012' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447319' label: secalert@redhat.com - url: 'https://bugzilla.samba.org/show_bug.cgi?id=16003' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:22644' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:22963' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25049' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25979' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28053' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28054' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28055' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28056' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28057' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29863' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56786' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56853' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:56911' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:57483' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:59831' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60019' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:62409' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:62549' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65839' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65851' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65907' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-3012' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2447319' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3012.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-3012' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-3012' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00261 epssPercentile: 0.18202 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-05-27T00:00:00+00:00' ingestedAt: '2026-07-03T13:02:27.343Z' --- ## Overview A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications. ## Affected - `openshift_container_platform = 4.0` - `samba >= 4.16.0, < 4.21.0` - `enterprise_linux = 7.0` - `enterprise_linux = 9.0` ## Remediation Upgrade past the affected range: - `samba 4.21.0` ## Vendor advisories - **RHSA-2026:59831** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:59831) - **RHSA-2026:56786** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:56786) - **RHSA-2026:56911** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:56911) - **RHSA-2026:56853** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:56853) - **RHSA-2026:62549** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:62549) - **RHSA-2026:60019** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:60019) - **RHSA-2026:57483** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:57483) - **RHSA-2026:29863** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:29863) - **RHSA-2026:28055** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-06-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:28055) - **RHSA-2026:22963** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22963) - **RHSA-2026:22644** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:22644) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3012.json) - **RHSA-2026:62409** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:62409) - **RHSA-2026:65907** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65907) - **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851) - **RHSA-2026:65839** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65839)