CVE-2026-3012 Samba: group policy certificate enrollment uses http:// without validation

What is CVE-2026-3012?

CVE-2026-3012 is a high-severity vulnerability in Redhat Enterprise Linux, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.

Weakness: CWE-345

Which versions are affected by CVE-2026-3012?

It affects 3 products.

Products include Redhat Enterprise Linux, Redhat Openshift Container Platform, Samba Samba.

How do I fix CVE-2026-3012?

Apply the vendor's patch.

Is CVE-2026-3012 being exploited?

There is no known exploitation of CVE-2026-3012 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux

• CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Exploited Critical 9.8
• CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit Critical 9.8
• CVE-2018-25011 Memory corruption in libwebp Critical 9.8
• CVE-2018-25014 Other in libwebp Critical 9.8
• CVE-2014-3585 Supply chain in redhat-upgrade-tool Critical 9.8

All Redhat Enterprise Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-3012, AZL-88877, CLSA-2026-1781513275, CLSA-2026-1782146244, DEBIAN-CVE-2026-3012, ECHO-e772-f0e1-af40 and 2 more.