CVE-2026-3012 · Co-reporter · Fixed May 26, 2026

Samba’s certificate auto-enrollment could fetch a certificate-authority certificate over unencrypted HTTP without checking its authenticity. Someone able to intercept that traffic could substitute a different certificate, affecting the trust anchor installed on the machine.

The issue was introduced in Samba 4.16, but exposure depended on both Group Policy processing and certificate auto-enrollment being enabled. These are non-default conditions, and interception also requires a suitable network position. Samba assigned the issue a CVSS score of 8.0.

The fix removed the HTTP retrieval path and relied on certificate information available through protected LDAP. Security releases 4.22.10, 4.23.8, and 4.24.3 included the correction. The advisory credits Michalis Vasileiadis alongside Arad Inbar, Nir Somech, and Ben Grinberg of DREAM Security as reporters. Douglas Bagnall and the Samba team provided the patch and advisory.

CVE-2026-35388 · Reporter · Fixed April 2, 2026

OpenSSH’s client can share an existing connection between sessions. When a user asks for confirmation before allowing that sharing, the approval check needs to apply consistently. Proxy-mode multiplexing did not perform the requested confirmation, leaving a gap between the user’s chosen policy and the client’s behavior.

This was a narrow, client-side issue. Practical exposure depended on a particular local configuration and user interaction. Ubuntu’s CVE record classifies it as low severity, with a score of 2.5; severity assessments can differ between vendors.

The correction restored the confirmation check in the affected path and shipped in OpenSSH 10.3 / 10.3p1 on April 2, 2026. The upstream release notes credit Michalis Vasileiadis as the reporter. The linked upstream commit documents the implementation change. The contribution here was reporting the approval-check gap; no patch authorship is claimed.