Vulnerability-Lookup

CVE-2026-12249 (GCVE-0-2026-12249)

Vulnerability from cvelistv5 – Published: 2026-06-22 15:43 – Updated: 2026-06-22 17:30

Title

Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment

Summary

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:I/V:D/RE:L/U:Red

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-348 - Improper verification of cryptographic signature

Assigner

canonical

References

2 references

URL	Tags
https://ubuntu.com/security/CVE-2026-12249	vdb-entryissue-tracking
https://github.com/ubuntu/adsys/commit/8b1939f96d…	patch

Impacted products

6 products

Vendor	Product	Version
		Affected: 0.13.0 , < 0.16.3 (semver)
Canonical	Ubuntu 20.04 LTS	Unaffected: 0.9.2~20.04.2ubuntu0.1+esm2 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 0.16.3~22.04.2ubuntu0.22.04.1 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 0.16.3~24.04.2ubuntu0.24.04.1 (dpkg)
Canonical	Ubuntu 25.10	Unaffected: 0.16.3 (dpkg)
Canonical	Ubuntu 26.04 LTS	Unaffected: 0.16.4ubuntu1 (dpkg)

Date Public

2026-06-19 11:58

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:30:38.451893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:30:57.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "adsys",
          "repo": "https://github.com/ubuntu/adsys",
          "versions": [
            {
              "lessThan": "0.16.3",
              "status": "affected",
              "version": "0.13.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "unaffected",
          "packageName": "adsys",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/adsys",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.9.2~20.04.2ubuntu0.1+esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "adsys",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/adsys",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.16.3~22.04.2ubuntu0.22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "adsys",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/adsys",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.16.3~24.04.2ubuntu0.24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/questing",
          "defaultStatus": "unaffected",
          "packageName": "adsys",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 25.10",
          "repo": "https://launchpad.net/ubuntu/+source/adsys",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.16.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "unaffected",
          "packageName": "adsys",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/adsys",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.16.4ubuntu1",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "datePublic": "2026-06-19T11:58:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "IRRECOVERABLE",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "PROOF_OF_CONCEPT",
            "privilegesRequired": "NONE",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:I/V:D/RE:L/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T15:45:03.920Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2026-12249"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2026-12249",
    "datePublished": "2026-06-22T15:43:33.890Z",
    "dateReserved": "2026-06-15T08:01:59.335Z",
    "dateUpdated": "2026-06-22T17:30:57.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-12249\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-22T17:30:38.451893Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-22T17:30:52.627Z\"}}], \"cna\": {\"title\": \"Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment\", \"source\": {\"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-94\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-94 Adversary in the Middle (AiTM)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NEGLIGIBLE\", \"version\": \"4.0\", \"Recovery\": \"IRRECOVERABLE\", \"baseScore\": 9, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"DIFFUSE\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:I/V:D/RE:L/U:Red\", \"exploitMaturity\": \"PROOF_OF_CONCEPT\", \"providerUrgency\": \"RED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/ubuntu/adsys\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.13.0\", \"lessThan\": \"0.16.3\", \"versionType\": \"semver\"}], \"packageName\": \"adsys\", \"collectionURL\": \"https://github.com/ubuntu\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://launchpad.net/ubuntu/+source/adsys\", \"vendor\": \"Canonical\", \"product\": \"Ubuntu 20.04 LTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.9.2~20.04.2ubuntu0.1+esm2\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"adsys\", \"collectionURL\": \"https://launchpad.net/ubuntu/focal\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://launchpad.net/ubuntu/+source/adsys\", \"vendor\": \"Canonical\", \"product\": \"Ubuntu 22.04 LTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.16.3~22.04.2ubuntu0.22.04.1\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"adsys\", \"collectionURL\": \"https://launchpad.net/ubuntu/jammy\", \"defaultStatus\": \"affected\"}, {\"repo\": \"https://launchpad.net/ubuntu/+source/adsys\", \"vendor\": \"Canonical\", \"product\": \"Ubuntu 24.04 LTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.16.3~24.04.2ubuntu0.24.04.1\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"adsys\", \"collectionURL\": \"https://launchpad.net/ubuntu/noble\", \"defaultStatus\": \"affected\"}, {\"repo\": \"https://launchpad.net/ubuntu/+source/adsys\", \"vendor\": \"Canonical\", \"product\": \"Ubuntu 25.10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.16.3\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"adsys\", \"collectionURL\": \"https://launchpad.net/ubuntu/questing\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://launchpad.net/ubuntu/+source/adsys\", \"vendor\": \"Canonical\", \"product\": \"Ubuntu 26.04 LTS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.16.4ubuntu1\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"adsys\", \"collectionURL\": \"https://launchpad.net/ubuntu/resolute\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-19T11:58:00.000Z\", \"references\": [{\"url\": \"https://ubuntu.com/security/CVE-2026-12249\", \"tags\": [\"vdb-entry\", \"issue-tracking\"]}, {\"url\": \"https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-348\", \"description\": \"Improper verification of cryptographic signature\"}]}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2026-06-22T15:45:03.920Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-12249\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-22T17:30:57.314Z\", \"dateReserved\": \"2026-06-15T08:01:59.335Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2026-06-22T15:43:33.890Z\", \"assignerShortName\": \"canonical\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-CRM4-Q7V4-C2R2

Vulnerability from github – Published: 2026-06-22 18:34 – Updated: 2026-06-22 18:34

Details

Severity

9.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

9.0 (Critical)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:I/V:D/RE:L/U:Red

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-12249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-348"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-22T18:16:31Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.",
  "id": "GHSA-crm4-q7v4-c2r2",
  "modified": "2026-06-22T18:34:17Z",
  "published": "2026-06-22T18:34:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12249"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/CVE-2026-12249"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:D/RE:L/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-12249 (GCVE-0-2026-12249)

GHSA-CRM4-Q7V4-C2R2

Tags

Sightings

Nomenclature