Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-18047 EUVD-2026-49793GHSA-5xgg-8pvj-x39g

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Published Jul 28, 2026 · Updated Nov 5, 2026 · Assigned by redhat

Description

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Certificate System 10 — —
Red Hat Red Hat Certificate System 11 — —
Red Hat Red Hat Certificate System 9 — —
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 11 dogtag-pki No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS dogtag-pki No fix yet —
Ubuntu Pro 20.04 LTS dogtag-pki No fix yet —
Ubuntu Pro 18.04 LTS dogtag-pki No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS dogtag-pki No fix yet —

References