Canonical Ubuntu Directory Certificate Service gp_cert_auto_enroll_ext.py less trusted source

Summaryinfo

A vulnerability was found in Canonical Ubuntu and classified as critical. Impacted is an unknown function of the file internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py of the component Directory Certificate Service. Such manipulation leads to less trusted source. This vulnerability is referenced as CVE-2026-12249. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Canonical Ubuntu (the affected version is unknown) and classified as critical. Affected by this issue is an unknown code of the file internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py of the component Directory Certificate Service. The manipulation with an unknown input leads to a less trusted source vulnerability. Using CWE to declare the problem leads to CWE-348. The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.

The advisory is shared for download at ubuntu.com. This vulnerability is handled as CVE-2026-12249 since 06/15/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

It is declared as proof-of-concept.

Upgrading eliminates this vulnerability. Applying the patch 8b1939f96d3827b4426eb06c1ced5bf317b0a99d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Canonical

Name

• Ubuntu

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion