CVE-2021-43566

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

• CWE-362

• https://bugzilla.samba.org/show_bug.cgi?id=13979Exploit, Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220110-0001/Third Party Advisory
• https://www.samba.org/samba/security/CVE-2021-43566.htmlPatch, Vendor Advisory
• https://bugzilla.samba.org/show_bug.cgi?id=13979Exploit, Issue Tracking, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220110-0001/Third Party Advisory
• https://www.samba.org/samba/security/CVE-2021-43566.htmlPatch, Vendor Advisory

Published

Jan 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43560A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 …5.3
• CVE-2021-43561An XSS issue was discovered in the google_for_jobs (aka Goog…5.4
• CVE-2021-43562An issue was discovered in the pixxio (aka pixx.io integrati…8.8
• CVE-2021-43563An issue was discovered in the pixxio (aka pixx.io integrati…8.8
• CVE-2021-43564An issue was discovered in the jobfair (aka Job Fair) extens…7.5
• CVE-2021-43565The x/crypto/ssh package before 0.0.0-20211202192323-5770296…7.5
• CVE-2021-43568The verify function in the Stark Bank Elixir ECDSA library (…9.8
• CVE-2021-43569The verify function in the Stark Bank .NET ECDSA library (ec…9.8
• CVE-2021-4357The uListing plugin for WordPress is vulnerable to authoriza…5.3
• CVE-2021-43570The verify function in the Stark Bank Java ECDSA library (ec…9.8
• CVE-2021-43571The verify function in the Stark Bank Node.js ECDSA library …9.8
• CVE-2021-43572The verify function in the Stark Bank Python ECDSA library (…9.8