CVE-2026-58218 in Red Hat
Summary
by MITRE • 07/30/2026
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability resides within Samba's internal DNS server implementation where improper handling of TKEY registration requests creates a denial of service condition through cache exhaustion. The flaw manifests when the system accepts unauthenticated TKEY requests and stores them in the TKEY name cache before validating their authenticity, creating an exploitable race condition that allows remote attackers to flood the cache with arbitrary entries.
The technical mechanism involves the TKEY record processing within Samba's DNS server where authentication checks occur after cache insertion rather than before. This design flaw enables attackers to submit numerous TKEY registration requests containing random or crafted names without providing valid TSIG signatures. Each request gets cached regardless of authentication status, leading to rapid cache population with invalid entries that eventually evict legitimate cache items.
From a security perspective, this vulnerability maps directly to CWE-20, representing improper input validation in the context of DNS name handling and caching operations. The attack vector operates entirely over the network without requiring any authentication credentials, making it particularly dangerous for systems that rely on DNS-based service discovery or TSIG-signed queries for secure communications.
The operational impact extends beyond simple denial of service as it disrupts legitimate DNS operations that depend on proper cache management. When the TKEY cache becomes exhausted, the system cannot properly handle valid TSIG-authenticated queries, effectively blocking authorized DNS transactions and potentially disrupting services that depend on Samba's DNS functionality for name resolution or service discovery.
This vulnerability aligns with ATT&CK technique T1498, specifically focusing on network denial of service through resource exhaustion. The attack pattern follows a classic cache poisoning approach where the attacker leverages the system's own caching mechanism against itself by flooding it with invalid entries that consume memory resources.
Mitigation strategies should prioritize implementing rate limiting on TKEY registration requests to prevent rapid cache population. Network administrators should configure Samba to limit the number of concurrent TKEY operations and implement proper authentication checks before cache insertion. Additionally, monitoring cache utilization metrics can help detect anomalous behavior indicating potential exploitation attempts. The most effective long-term solution involves patching the underlying implementation to validate authentication status before adding entries to the TKEY cache, ensuring that only legitimate requests are stored in memory resources.