Skip to content
OpenAdvisories
High ALSA-2026:43400 2 CVEs

Important: dogtag-pki security update

Published Jul 22, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 8

ReleasePackageFixed in
AlmaLinux · 10 idm-pki-acme 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-base 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-ca 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-java 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-kra 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-server 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 idm-pki-tools 11.9.0-4.el10_2.alma.1
AlmaLinux · 10 python3-idm-pki 11.9.0-4.el10_2.alma.1

Vulnerabilities 2

  • High 8.1
    CVE-2026-54512 Public exploit

    jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymor…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-54513

    jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-54512
  • report
    https://access.redhat.com/security/cve/CVE-2026-54513
  • report
    https://bugzilla.redhat.com/2492010
  • report
    https://bugzilla.redhat.com/2492015
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-43400.html