CVE-2026-4408

Name
CVE-2026-4408
Description
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
secalert@redhat.com https://access.redhat.com/security/cve/CVE-2026-4408
secalert@redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2479762
secalert@redhat.com https://bugzilla.samba.org/show_bug.cgi?id=16034
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:22644
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:22963
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:25049
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:25979
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28057
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28058
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28054
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28055
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28056
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28053
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:28132
0b0ca135-0b70-47e7-9f44-1890c2a1c46c https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4408.json
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:29833
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:29799
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:29863

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* openshift_container_platform == None == 4.0
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.1.0 < 4.21.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* enterprise_linux == None == 6.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* enterprise_linux == None == 7.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* enterprise_linux == None == 9.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
samba edge-main 4.23.8-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
samba edge-main 4.20.6-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.20.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.5-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.4-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.19.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.10-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.9-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.9-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.7-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.18.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.17.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.17.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.17.4-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.17.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.17.0-r0 None possibly vulnerable
samba edge-main 4.16.8-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.16.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.16.7-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.16.7-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.16.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.16.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.15.9-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.15.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.15.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.14.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba edge-main 4.14.2-r0 None possibly vulnerable
samba edge-main 4.12.9-r0 None possibly vulnerable
samba edge-main 4.12.7-r0 None possibly vulnerable
samba edge-main 4.12.5-r0 None possibly vulnerable
samba edge-main 4.12.2-r0 None possibly vulnerable
samba edge-main 4.11.5-r0 None possibly vulnerable
samba edge-main 4.11.3-r0 None possibly vulnerable
samba edge-main 4.11.2-r0 None possibly vulnerable
samba edge-main 4.10.8-r0 None possibly vulnerable
samba edge-main 4.10.5-r0 None possibly vulnerable
samba edge-main 4.10.3-r0 None possibly vulnerable
samba edge-main 4.8.11-r0 None possibly vulnerable
samba edge-main 4.8.7-r0 None possibly vulnerable
samba edge-main 4.8.4-r0 None possibly vulnerable
samba edge-main 4.7.6-r0 None possibly vulnerable
samba edge-main 4.7.3-r0 None possibly vulnerable
samba edge-main 4.7.0-r0 None possibly vulnerable
samba edge-main 4.6.1-r0 None possibly vulnerable
samba 3.24-main 4.23.8-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
samba 3.23-main 4.22.10-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
samba 3.22-main 4.18.9-r0 None possibly vulnerable
samba 3.22-main 4.18.8-r0 None possibly vulnerable
samba 3.22-main 4.18.1-r0 None possibly vulnerable
samba 3.22-main 4.17.0-r0 None possibly vulnerable
samba 3.22-main 4.16.7-r0 None possibly vulnerable
samba 3.22-main 4.16.6-r0 None possibly vulnerable
samba 3.22-main 4.15.9-r0 None possibly vulnerable
samba 3.22-main 4.15.2-r0 None possibly vulnerable
samba 3.22-main 4.15.0-r0 None possibly vulnerable
samba 3.22-main 4.14.4-r0 None possibly vulnerable
samba 3.22-main 4.14.2-r0 None possibly vulnerable
samba 3.22-main 4.12.9-r0 None possibly vulnerable
samba 3.22-main 4.12.7-r0 None possibly vulnerable
samba 3.22-main 4.12.5-r0 None possibly vulnerable
samba 3.22-main 4.12.2-r0 None possibly vulnerable
samba 3.22-main 4.11.5-r0 None possibly vulnerable
samba 3.22-main 4.11.3-r0 None possibly vulnerable
samba 3.22-main 4.11.2-r0 None possibly vulnerable
samba 3.22-main 4.10.8-r0 None possibly vulnerable
samba 3.22-main 4.10.5-r0 None possibly vulnerable
samba 3.22-main 4.10.3-r0 None possibly vulnerable
samba 3.22-main 4.8.11-r0 None possibly vulnerable
samba 3.22-main 4.8.7-r0 None possibly vulnerable
samba 3.22-main 4.8.4-r0 None possibly vulnerable
samba 3.22-main 4.7.6-r0 None possibly vulnerable
samba 3.22-main 4.7.3-r0 None possibly vulnerable
samba 3.22-main 4.7.0-r0 None possibly vulnerable
samba 3.22-main 4.6.1-r0 None possibly vulnerable
samba 3.21-main 4.20.6-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba 3.21-main 4.18.9-r0 None possibly vulnerable
samba 3.21-main 4.18.8-r0 None possibly vulnerable
samba 3.21-main 4.18.1-r0 None possibly vulnerable
samba 3.21-main 4.17.0-r0 None possibly vulnerable
samba 3.21-main 4.16.7-r0 None possibly vulnerable
samba 3.21-main 4.16.6-r0 None possibly vulnerable
samba 3.21-main 4.15.9-r0 None possibly vulnerable
samba 3.21-main 4.15.2-r0 None possibly vulnerable
samba 3.21-main 4.15.0-r0 None possibly vulnerable
samba 3.21-main 4.14.4-r0 None possibly vulnerable
samba 3.21-main 4.14.2-r0 None possibly vulnerable
samba 3.21-main 4.12.9-r0 None possibly vulnerable
samba 3.21-main 4.12.7-r0 None possibly vulnerable
samba 3.21-main 4.12.5-r0 None possibly vulnerable
samba 3.21-main 4.12.2-r0 None possibly vulnerable
samba 3.21-main 4.11.5-r0 None possibly vulnerable
samba 3.21-main 4.11.3-r0 None possibly vulnerable
samba 3.21-main 4.11.2-r0 None possibly vulnerable
samba 3.21-main 4.10.8-r0 None possibly vulnerable
samba 3.21-main 4.10.5-r0 None possibly vulnerable
samba 3.21-main 4.10.3-r0 None possibly vulnerable
samba 3.21-main 4.8.11-r0 None possibly vulnerable
samba 3.21-main 4.8.7-r0 None possibly vulnerable
samba 3.21-main 4.8.4-r0 None possibly vulnerable
samba 3.21-main 4.7.6-r0 None possibly vulnerable
samba 3.21-main 4.7.3-r0 None possibly vulnerable
samba 3.21-main 4.7.0-r0 None possibly vulnerable
samba 3.21-main 4.6.1-r0 None possibly vulnerable
samba 3.20-main 4.19.9-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba 3.20-main 4.19.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba 3.20-main 4.18.9-r0 None possibly vulnerable
samba 3.20-main 4.18.8-r0 None possibly vulnerable
samba 3.20-main 4.18.1-r0 None possibly vulnerable
samba 3.20-main 4.17.0-r0 None possibly vulnerable
samba 3.20-main 4.16.7-r0 None possibly vulnerable
samba 3.20-main 4.16.6-r0 None possibly vulnerable
samba 3.20-main 4.15.9-r0 None possibly vulnerable
samba 3.20-main 4.15.2-r0 None possibly vulnerable
samba 3.20-main 4.15.0-r0 None possibly vulnerable
samba 3.20-main 4.14.4-r0 None possibly vulnerable
samba 3.20-main 4.14.2-r0 None possibly vulnerable
samba 3.20-main 4.12.9-r0 None possibly vulnerable
samba 3.20-main 4.12.7-r0 None possibly vulnerable
samba 3.20-main 4.12.5-r0 None possibly vulnerable
samba 3.20-main 4.12.2-r0 None possibly vulnerable
samba 3.20-main 4.11.5-r0 None possibly vulnerable
samba 3.20-main 4.11.3-r0 None possibly vulnerable
samba 3.20-main 4.11.2-r0 None possibly vulnerable
samba 3.20-main 4.10.8-r0 None possibly vulnerable
samba 3.20-main 4.10.5-r0 None possibly vulnerable
samba 3.20-main 4.10.3-r0 None possibly vulnerable
samba 3.20-main 4.8.11-r0 None possibly vulnerable
samba 3.20-main 4.8.7-r0 None possibly vulnerable
samba 3.20-main 4.8.4-r0 None possibly vulnerable
samba 3.20-main 4.7.6-r0 None possibly vulnerable
samba 3.20-main 4.7.3-r0 None possibly vulnerable
samba 3.20-main 4.7.0-r0 None possibly vulnerable
samba 3.20-main 4.6.1-r0 None possibly vulnerable
samba 3.19-main 4.18.11-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba 3.19-main 4.18.9-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
samba 3.19-main 4.18.8-r0 None possibly vulnerable
samba 3.19-main 4.18.1-r0 None possibly vulnerable
samba 3.19-main 4.17.0-r0 None possibly vulnerable
samba 3.19-main 4.16.7-r0 None possibly vulnerable
samba 3.19-main 4.16.6-r0 None possibly vulnerable
samba 3.19-main 4.15.9-r0 None possibly vulnerable
samba 3.19-main 4.15.2-r0 None possibly vulnerable
samba 3.19-main 4.15.0-r0 None possibly vulnerable
samba 3.19-main 4.14.4-r0 None possibly vulnerable
samba 3.19-main 4.14.2-r0 None possibly vulnerable
samba 3.19-main 4.12.9-r0 None possibly vulnerable
samba 3.19-main 4.12.7-r0 None possibly vulnerable
samba 3.19-main 4.12.5-r0 None possibly vulnerable
samba 3.19-main 4.12.2-r0 None possibly vulnerable
samba 3.19-main 4.11.5-r0 None possibly vulnerable
samba 3.19-main 4.11.3-r0 None possibly vulnerable
samba 3.19-main 4.11.2-r0 None possibly vulnerable
samba 3.19-main 4.10.8-r0 None possibly vulnerable
samba 3.19-main 4.10.5-r0 None possibly vulnerable
samba 3.19-main 4.10.3-r0 None possibly vulnerable
samba 3.19-main 4.8.11-r0 None possibly vulnerable
samba 3.19-main 4.8.7-r0 None possibly vulnerable
samba 3.19-main 4.8.4-r0 None possibly vulnerable
samba 3.19-main 4.7.6-r0 None possibly vulnerable
samba 3.19-main 4.7.3-r0 None possibly vulnerable
samba 3.19-main 4.7.0-r0 None possibly vulnerable
samba 3.19-main 4.6.1-r0 None possibly vulnerable