diff --git a/source/passdb/secrets.c b/source/passdb/secrets.c
index d6a0e89bbaf..ffe9e45036c 100644
--- a/source/passdb/secrets.c
+++ b/source/passdb/secrets.c
@@ -399,6 +399,7 @@ bool secrets_fetch_trust_account_password_legacy(const char *domain,
 
 	if (size != sizeof(*pass)) {
 		DEBUG(0, ("secrets were of incorrect size!\n"));
+		SAFE_FREE(pass);
 		return False;
 	}