CVE-2026-4408: Samba Check Password Script Remote Command Execution

Technical summary

CVE-2026-4408 is a shell metacharacter injection flaw in Samba's check password script handler. When the check password script feature is enabled with %u substitution, Samba passes the client-supplied username directly to the shell without sanitizing shell metacharacters. An unauthenticated remote attacker can craft a malicious username containing shell operators (pipes, command substitution, redirects, etc.) that execute arbitrary commands in the context of the samba-dcerpcd service. The CVSS 3.1 score of 9.0 (CRITICAL) reflects network accessibility, high impact across confidentiality, integrity, and availability, though exploitation requires the specific script configuration and service architecture to be in place.

Business impact

This vulnerability poses severe risk to organizations using Samba-based file services or acting as domain controllers, particularly in hybrid or legacy environments. Successful exploitation enables attackers to gain command execution on identity and file infrastructure, potentially leading to lateral movement, data exfiltration, ransomware deployment, or disruption of authentication services. The blast radius depends on service privileges and network exposure; systems running samba-dcerpcd as a system service are at heightened risk. Organizations relying on Samba for compliance-sensitive functions (HIPAA, PCI-DSS, SOX) face compounded operational and regulatory consequences.

Affected systems

Red Hat Enterprise Linux (multiple versions), Red Hat OpenShift Container Platform, and Samba installations are affected. The vulnerability is specific to deployments where: (1) check password script is configured, (2) %u substitution is used in the script configuration, and (3) samba-dcerpcd runs as a system service. Standard default Samba configurations are not affected. Organizations should audit their Samba configurations to identify if check password script is in use and how it handles username substitution.

Exploitability

The vulnerability has a CVSS access complexity rating of High, meaning exploitation is not trivial; attackers must identify systems with the specific configuration and craft appropriate shell metacharacter payloads. However, once a vulnerable configuration is confirmed, the attack is reliable and requires no credentials or user interaction. The attack surface is network-wide for any exposed Samba service. There is currently no evidence of active exploitation in the wild (KEV status: not listed).

Remediation

Organizations must remediate by upgrading Samba to a patched version; verify the specific version numbers in Red Hat and Samba security advisories. For environments unable to patch immediately, disable or reconfigure the check password script feature, remove %u substitution from any active scripts, or restrict network access to Samba services via firewall rules. Review samba-dcerpcd service configuration to ensure it runs with minimal necessary privileges and not as root where possible.

Patch guidance

Apply security updates from Red Hat (RHEL versions) and Samba project as they become available. Consult official Red Hat Security Advisories and Samba release notes for specific CVE-2026-4408 patch versions and upgrade paths for your deployed version. Test patches in a non-production environment first, given the critical nature of file and authentication infrastructure. Organizations on OpenShift Container Platform should watch for container image updates that include patched Samba binaries.

Detection guidance

Monitor samba-dcerpcd process execution logs and system call traces for unusual child process spawning or shell invocations (e.g., /bin/bash, /bin/sh) originating from the Samba service. Audit authentication logs for suspicious username patterns containing shell metacharacters (backticks, $(), |, &, ;, etc.). Configure SIEM rules to alert on check password script invocations that fail or produce unexpected exit codes. Network-level detection is difficult without payload inspection, but behavioral anomalies (file system changes, outbound connections from Samba process) may signal post-exploitation activity.

Why prioritize this

This vulnerability merits immediate prioritization due to its CRITICAL severity score, network exploitability without authentication, and potential for complete system compromise. While exploitation requires a non-standard configuration, the consequence—direct command execution on identity and file infrastructure—is extreme. Any organization confirming the vulnerable configuration should treat this as urgent. Even those on default configs should verify their Samba deployment does not inadvertently use check password script.

Risk score, explained

The CVSS 3.1 score of 9.0 reflects: Network vector (remote attack), High complexity (requires specific config), no privilege or user interaction required, and confidentiality/integrity/availability impact rated as High. The score is tempered slightly by configuration-specificity (AC:H), but the overall severity remains CRITICAL because the impact—complete system compromise—is maximal when conditions align.

Frequently asked questions