Samba CVE-2026-4408: Overview of Unauthenticated Remote Code Execution via SAMR Password Script Injection

Introduction

A shell meta-character injection flaw in Samba's SAMR password validation service lets unauthenticated attackers run arbitrary commands on servers that use the "check password script" feature with the %u substitution placeholder. The Samba project itself rates this vulnerability at CVSS 10.0. Two security research teams, SafeBreach and ZeroPath, found it independently, which makes it more likely that threat actors are aware of the flaw too.

The vulnerable configuration is non-default, which limits the immediate blast radius. But Samba is deployed across nearly every Linux distribution, so the aggregate number of potentially affected systems is still significant. This applies most to organizations running custom Samba configurations on file servers or classic domain controllers, where the "check password script" feature is most likely to be in use.

Technical Information

Root Cause: CWE-78 OS Command Injection

CVE-2026-4408 is an unauthenticated remote code execution vulnerability in the Samba DCE/RPC SAMR (Security Account Manager Remote) server. The root cause is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) weakness in how Samba handles the %u substitution character within the check password script configuration directive.

When Samba's SamValidatePasswordChange or SamValidatePasswordReset RPC services operate over the NCACN_IP_TCP protocol transport, they invoke the administrator-configured check password script from smb.conf. If that script uses the %u placeholder, Samba expands it with the client-supplied username, and it does not escape shell meta-characters during that expansion. The username string goes straight to the system shell, so any shell operators embedded in the username (semicolons, pipes, ampersands, dollar signs, backticks) are interpreted as shell syntax rather than literal characters.

This is the same weakness class as the notorious CVE-2007-2447, a Samba command injection from 2007 that was widely exploited in the wild. Nearly two decades later, the same fundamental mechanism has turned up again in a different subsystem.

CVSS Score Discrepancy

Scoring bodies disagree meaningfully on how severe this vulnerability is:

The Samba project's vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In their assessment, the attack has low complexity, needs no authentication or user interaction, and achieves changed scope with full impact on confidentiality, integrity, and availability. Organizations should use the highest applicable score when prioritizing risk.

Attack Flow

The attack runs in four steps:

1. The attacker connects to the Samba DCE/RPC SAMR service over NCACN_IP_TCP. No authentication is required.

2. The attacker sends a SamValidatePasswordChange or SamValidatePasswordReset RPC request containing a malicious username with embedded shell meta-characters (e.g., user; malicious_command).

3. The Samba server substitutes the attacker-controlled username into the check password script at the %u position without any sanitization or escaping.

4. The system shell executing the script interprets the meta-characters and runs the injected command with the privileges of the samba-dcerpcd process.

Apart from the vulnerable configuration, the chain needs no credentials, no user interaction, and no special timing.

Required Configuration Conditions

Exploitation needs all three of these non-default configuration conditions at once:

Active Directory Domain Controllers are not affected, because they do not expand the username through the %u substitution character.

Why Single-Quote Wrapping Is Insufficient

According to the Samba advisory, wrapping %u in single quotes in the configuration (e.g., check password script = /path/to/script '%u') reduces the risk but does not eliminate it. Quoting blocks shell command injection through operators like ;, but command-line option injection is still possible. An attacker could craft a username that adds options and changes how the invoked script behaves. Single quotes are a mitigation, and only a partial one.

Companion Vulnerability: CVE-2026-4480

CVE-2026-4480, disclosed alongside CVE-2026-4408, is another unauthenticated RCE, this time in the Samba printing subsystem. It also passes client-controlled input with unescaped shell characters to configured commands, in this case through print job descriptions. Administrators have two critical vulnerabilities to patch at the same time and should address them together.

Patch Information

On May 26, 2026, the Samba project released coordinated security updates in versions 4.24.3, 4.23.8, and 4.22.10, all of which contain the fix for CVE-2026-4408. Patch files and source tarballs are available from the official Samba security page. The upstream fix is tracked under Samba Bugzilla Bug 16034.

The fix sanitizes the username value substituted into %u before it reaches the system shell, so a crafted username can no longer inject arbitrary shell commands. Before the patch, even quoting %u with single quotes in the script configuration was not enough, because command-line option injection was still possible. The patched code path closes both vectors.

Stefan Metzmacher (SerNet / Samba Team) and Douglas Bagnall (Catalyst / Samba Team) wrote the patches. Volker Lendecke and Stefan Metzmacher co-wrote the advisory.

Distribution-Specific Updates

Downstream Linux distributions adopted the upstream fix quickly:

Workaround When Patching Is Not Immediately Possible

The official advisory gives a workaround for administrators who cannot upgrade yet: remove %u from the check password script configuration in smb.conf, and have the script read the username from the SAMBA_CPS_ACCOUNT_NAME environment variable instead. This removes the injection vector entirely, without a software update.

Leaving the rpc start on demand helpers setting at its default value of yes also keeps the vulnerable code path unreachable, because of the way samba-dcerpcd is then started.

As a defense-in-depth measure, use network segmentation to restrict access to Samba DCE/RPC services (particularly NCACN_IP_TCP on the SAMR pipe) to trusted networks only.

Affected Systems and Versions

According to the official Samba advisory, all versions of Samba are affected when the vulnerable configuration conditions are met.

The three required conditions are:

1. The check password script directive in smb.conf uses the %u substitution character
2. samba-dcerpcd is started as a system service (i.e., rpc start on demand helpers = no)
3. Samba is running as a file server or classic (non-AD) domain controller

Active Directory Domain Controllers are not affected, because they do not expand the username through %u.

The patched versions are:

Vendor Security History

Samba has a documented history of security vulnerabilities. These entries give context for CVE-2026-4408:

CVE-2007-2447 is the striking entry here. Like CVE-2026-4408, it passed user-controlled input to external scripts without escaping shell meta-characters. CVE-2007-2447 was widely exploited after disclosure. That the exact same weakness class has come back nearly two decades later suggests that external script invocations remain a persistent source of command injection risk in the Samba codebase.

The Samba project's security process has been consistently responsive. It released patches for multiple release branches at the same time and coordinated closely with downstream Linux distributors, and Red Hat, Ubuntu, SUSE, and Debian rolled out fixes within days of disclosure.

References

• NVD: CVE-2026-4408
• Samba Security Advisory: CVE-2026-4408
• Samba Bugzilla Bug 16034
• Red Hat Bugzilla: 2479762
• Red Hat CVE Page: CVE-2026-4408
• RHSA-2026:8322 Security Advisory
• RHSA-2026:15980 Security Advisory
• Ubuntu Security Notice USN-8306-1
• Debian Security Tracker: CVE-2026-4408
• SUSE-SU-2026:2076-1
• SUSE-SU-2026:2073-1
• Amazon Linux CVE-2026-4408
• Samba 4.24.3 Release Notes
• Samba 4.22.10 Release Notes
• Samba 4.24.3, 4.23.8, and 4.22.10 Released (LinuxCompatible)
• Tenable Nessus Plugin 316852
• Samba Security Updates and Information
• NVD: CVE-2026-4480
• Red Hat CVE Page: CVE-2026-4480
• Feedly CVE-2026-4408 Tracking