7.2
High
CVE-2026-76561 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
Description
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Certificate System 9 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published |
Show the 8 other branches Hide the 8 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020261027104450.693 | earliest → < 8080020261027104450.693a3987 | 8080020261027104450.693a3987 |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020261027104450.693 | earliest → < 8080020261027104450.693a3987 | 8080020261027104450.693a3987 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020261023060923.60523 | earliest → < 8060020261023060923.60523a7b | 8060020261023060923.60523a7b |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020261023060923.60523 | earliest → < 8060020261023060923.60523a7b | 8060020261023060923.60523a7b |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020261030163632.17 | earliest → < 8040020261030163632.17df0a3f | 8040020261030163632.17df0a3f |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020261030163632.17 | earliest → < 8040020261030163632.17df0a3f | 8040020261030163632.17df0a3f |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions not published |
Other CVEs of Red Hat Certificate System 9
The 9 CVEs of Red Hat Certificate System 9 →
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
8.1
High
CVE-2026-80110
Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint
8.1
High
CVE-2026-53682
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
5.3
Medium
CVE-2026-11873
Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
6.5
Medium