Critical
Samba: remote code execution in samr
Type: advisorySources: OSV
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-4408
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:55 UTC · Revision 1
Source evidence
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
osv:CVE-2026-4408
Complete source record
{
"id": "d521db95fe08a7607f445e50cbfdc2861f0de2a7675a14b9f9a224ed0502c7d6",
"url": "https://osv.dev/vulnerability/CVE-2026-4408",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Samba: remote code execution in samr",
"summary": "A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the \"check password script\" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the \"check password script\" is used with %u and the samba-dcerpcd service is started as a system service.",
"evidence": "osv:CVE-2026-4408",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-4408",
"aliases": [
"CVE-2026-4408"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/samba-team/samba",
"type": "GIT",
"events": [
{
"introduced": "a6fb418be7adccdd583a3b489b58023cfdd392ef"
},
{
"fixed": "1c7d4b5b388ae2647732ed54834d5547a8c1357a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.21.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4408.json"
}
}
],
"modified": "2026-10-28T02:30:41.094873603Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4408.json",
"https://access.redhat.com/errata/RHSA-2026:22644",
"https://access.redhat.com/errata/RHSA-2026:22963",
"https://access.redhat.com/errata/RHSA-2026:25049",
"https://access.redhat.com/errata/RHSA-2026:25979",
"https://access.redhat.com/errata/RHSA-2026:28053",
"https://access.redhat.com/errata/RHSA-2026:28054",
"https://access.redhat.com/errata/RHSA-2026:28055",
"https://access.redhat.com/errata/RHSA-2026:28056",
"https://access.redhat.com/errata/RHSA-2026:28057",
"https://access.redhat.com/errata/RHSA-2026:28058",
"https://access.redhat.com/errata/RHSA-2026:28132",
"https://access.redhat.com/errata/RHSA-2026:29799",
"https://access.redhat.com/errata/RHSA-2026:29833",
"https://access.redhat.com/errata/RHSA-2026:29863",
"https://access.redhat.com/errata/RHSA-2026:56786",
"https://access.redhat.com/errata/RHSA-2026:56853",
"https://access.redhat.com/errata/RHSA-2026:56911",
"https://access.redhat.com/errata/RHSA-2026:57483",
"https://access.redhat.com/errata/RHSA-2026:59831",
"https://access.redhat.com/errata/RHSA-2026:60019",
"https://access.redhat.com/errata/RHSA-2026:65839",
"https://access.redhat.com/security/cve/CVE-2026-4408",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4408.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-4408",
"https://bugzilla.redhat.com/show_bug.cgi?id=2479762",
"https://bugzilla.samba.org/show_bug.cgi?id=16034"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:4.23.5-109.el10_2"
},
{
"fixed": "0:4.21.3-114.el10_0.1"
},
{
"fixed": "0:4.10.16-26.el7_9.1"
},
{
"fixed": "0:4.10.16-26.el7_9.1"
},
{
"fixed": "0:4.19.4-16.el8_10"
},
{
"fixed": "0:4.19.4-16.el8_10"
},
{
"fixed": "0:4.13.3-12.el8_4.1"
},
{
"fixed": "0:4.13.3-12.el8_4.1"
},
{
"fixed": "0:4.15.5-16.el8_6.1"
},
{
"fixed": "0:4.15.5-16.el8_6.1"
},
{
"fixed": "0:4.17.5-7.el8_8.1"
},
{
"fixed": "0:4.17.5-7.el8_8.1"
},
{
"fixed": "0:4.23.5-10.el9_8"
},
{
"fixed": "0:4.23.5-10.el9_8"
},
{
"fixed": "0:4.17.5-105.el9_2.5"
},
{
"fixed": "0:4.19.4-105.el9_4.4"
},
{
"fixed": "0:4.21.3-14.el9_6.1"
},
{
"fixed": "412.86.202608241157-0"
},
{
"fixed": "413.92.202609080414-0"
},
{
"fixed": "414.92.202608172040-0"
},
{
"fixed": "415.92.202608180329-0"
},
{
"fixed": "416.94.202608150307-0"
},
{
"fixed": "417.94.202608250221-0"
},
{
"fixed": "418.94.202608142238-0"
},
{
"fixed": "4.19.9.6.202606241344-0"
},
{
"fixed": "4.20.9.6.202606241928-0"
},
{
"fixed": "4.21.9.6.202606241859-0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4408.json"
}
},
"related_cves": [
{
"value": "CVE-2026-4408",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508773,
"published_at": "2026-05-28T07:25:27.169+00:00"
}