TI-2026-10535 Aliases CVE-2026-12249 GHSA-crm4-q7v4-c2r2

Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment

MEDIUM 40CWE-348Published 2026-06-22 · Updated 2026-06-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00143 3rd percentileScored 2026-11-07

Fix Fixed adsys: 0.16.3Ubuntu 20.04 LTS (Canonical): 0.9.2~20.04.2ubuntu0.1+esm2+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	adsys	0.13.0 to before 0.16.3	0.16.3	Patch available	CNA
Canonical	Ubuntu 20.04 LTS	—	0.9.2~20.04.2ubuntu0.1+esm2	Patch available	CNA
Canonical	Ubuntu 22.04 LTS	—	0.16.3~22.04.2ubuntu0.22.04.1	Patch available	CNA
Canonical	Ubuntu 24.04 LTS	—	0.16.3~24.04.2ubuntu0.24.04.1	Patch available	CNA
Canonical	Ubuntu 25.10	—	0.16.3	Patch available	CNA
Canonical	Ubuntu 26.04 LTS	—	0.16.4ubuntu1	Patch available	CNA
—	github.com/ubuntu/adsys (Go)	before 0.16.3-0.20250318112551-8b1939f96d38	0.16.3-0.20250318112551-8b1939f96d38	Patch available	GHSA-crm4-q7v4-c2r2

adsys Vendor— Affected 0.13.0 to before 0.16.3 Fixed in 0.16.3 Patch available CNA
Ubuntu 20.04 LTS VendorCanonical Affected — Fixed in 0.9.2~20.04.2ubuntu0.1+esm2 Patch available CNA
Ubuntu 22.04 LTS VendorCanonical Affected — Fixed in 0.16.3~22.04.2ubuntu0.22.04.1 Patch available CNA
Ubuntu 24.04 LTS VendorCanonical Affected — Fixed in 0.16.3~24.04.2ubuntu0.24.04.1 Patch available CNA
Ubuntu 25.10 VendorCanonical Affected — Fixed in 0.16.3 Patch available CNA
Ubuntu 26.04 LTS VendorCanonical Affected — Fixed in 0.16.4ubuntu1 Patch available CNA
github.com/ubuntu/adsys (Go) Vendor— Affected before 0.16.3-0.20250318112551-8b1939f96d38 Fixed in 0.16.3-0.20250318112551-8b1939f96d38 Patch available GHSA-crm4-q7v4-c2r2

Remediation

Fix · CNA adsys Fixed in 0.16.3
Fix · CNA Ubuntu 20.04 LTS (Canonical) Fixed in 0.9.2~20.04.2ubuntu0.1+esm2
Fix · CNA Ubuntu 22.04 LTS (Canonical) Fixed in 0.16.3~22.04.2ubuntu0.22.04.1
Fix · CNA Ubuntu 24.04 LTS (Canonical) Fixed in 0.16.3~24.04.2ubuntu0.24.04.1
Fix · CNA Ubuntu 25.10 (Canonical) Fixed in 0.16.3
Fix · CNA Ubuntu 26.04 LTS (Canonical) Fixed in 0.16.4ubuntu1
Fix · GHSA-crm4-q7v4-c2r2 github.com/ubuntu/adsys (Go) Fixed in 0.16.3-0.20250318112551-8b1939f96d38 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-12249
2026-10-03 Alias added: GHSA-crm4-q7v4-c2r2

References

Patch 1

https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-12249

Other 3

TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8

See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences