CVE-2026-3012

Description

samba: group policy certificate enrollment uses http:// without validation

Red Hat statement

Red Hat Product Security has rated this vulnerability as Important severity. However, exploitation requires several specific non-default conditions to be met. The vulnerable code path is only reachable when Samba Group Policy processing is explicitly enabled using the ```apply group policies = yes``` configuration option and certificate auto-enrollment is configured through Group Policy. Hence, although the vulnerable code is present, it is not exploitable in default RHEL configurations. In addition, the attacker must have the ability to intercept or redirect adjacent-network HTTP traffic during certificate retrieval. Because exploitation depends on explicit administrative configuration changes and adjacent-network positioning, Red Hat assesses the attack complexity as High (AC:H).

CVSS v3: 8.0 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

Errata / fixed releases

Package state