Skip to content
Sign in
6.5 Medium

CVE-2026-18047 Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Description

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Red Hat Certificate System 10 Versions not published
Red Hat Certificate System 11 Versions not published
Red Hat Certificate System 9 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published

Other CVEs of Red Hat Certificate System 10

The 10 CVEs of Red Hat Certificate System 10 →
CVE-2026-104988 Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject 8.1 High CVE-2026-89058 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config 7.4 High CVE-2026-89059 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) 7.5 High CVE-2026-78323 Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates 6.5 Medium
Track this CVE