An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA certificate from the Active Directory Certificate Services server (GetCACert). An unauthenticated network attacker positioned between the managed Ubuntu host and the configured AD CS CA hostname can conduct a Man-in-the-Middle (MITM) attack. By intercepting the plaintext HTTP request, the attacker can supply an arbitrary, attacker-controlled Root CA certificate. Because the system automatically accepts this certificate and registers it into the local system trust store via update-ca-certificates, this results in system-wide trust store poisoning. Consequently, TLS clients utilizing the operating system trust store on the affected machine will accept rogue certificates for arbitrary domains, enabling persistent decryption and interception of subsequent TLS connections. This issue is resolved in version v0.16.3.
During automatic certificate retrieval (GetCACert) by the vendored Samba script (gp_cert_auto_enroll_ext.py), ADSys establishes an HTTP connection instead of HTTPS. An unauthenticated attacker positioned in the network path between the Ubuntu host and the AD CS server can intercept this request and respond with their own, arbitrarily crafted Root CA certificate. The system automatically registers the received certificate in the local trust store using update-ca-certificates (CWE-348: IP Address Spoofing / relying on unverified value), without verifying its authenticity. From that point on, all TLS clients using the system certificate store trust certificates issued by the attacker-controlled fake CA.
The attacker gains the ability to permanently decrypt and intercept subsequent TLS connections established by the compromised host, because its Root CA certificate is treated as trusted by the entire operating system. This enables credential theft, modification of transmitted data, and further network actions (lateral movement).
Update ADSys to version v0.16.3, where the issue has been resolved by replacing the HTTP connection with secure HTTPS. Details available in the vendor references: https://ubuntu.com/security/CVE-2026-12249 and commit: https://github.com/ubuntu/adsys/commit/8b1939f96d3827b4426eb06c1ced5bf317b0a99d
Canonical ADSys in versions up to v0.16.2 inclusive, running on Ubuntu hosts integrated with Active Directory and using the AD CS automatic certificate retrieval functionality (AD CS certificate auto-enrollment).
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:D/RE:L/U:Red