CVE-2026-4408 is a command injection flaw (CVSS 9.0, critical) in Samba file servers and classic domain controllers. If the check password script option uses the %u substitution, a client controlled username reaches a shell without escaping. Review that setting and apply your vendor update.
What's affected
The record says the issue affects Samba file servers and classic domain controllers that use the check password script feature with %u, where samba-dcerpcd is started as a system service. It describes this as mainly a non standard configuration.
Red Hat Enterprise Linux and OpenShift are listed, and the record carries several Red Hat errata (such as RHSA-2026:22644). The record gives no upstream Samba version numbers, so check Samba's security page or your distribution.
How to check if you're exposed
See whether the option is set:
testparm -sv | grep -i "check password script"
If it is set and contains %u, you are in the described configuration. Then confirm whether samba-dcerpcd runs as a system service, and read your installed version.
smbd --version
Compare it with your vendor's patched build.
What to do now
- Apply the vendor update for Samba, such as the Red Hat errata for your release.
- Until you can, remove the %u substitution from the check password script setting, or turn the script off.
- Make the script validate its input and quote arguments if you must keep it.
- Restrict network access to Samba services to the hosts that need them.
- Restart the Samba services after the change.
Why it matters
The weakness is CWE-78, OS command injection. A username from the client was placed into a shell command line without escaping special characters, so a crafted name can add commands. Shell metacharacters in names are a classic injection route.
The attack complexity is rated high because it needs this unusual setup. Where it exists, the impact reaches the whole server. The KEV flag is false.
Quick check
Is every Samba server at risk?
No. The record says it mainly affects non standard setups that use check password script with %u.
Sources
Last reviewed: 19 October 2026.
