Description
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Certificate System 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dogtag-pki +8 | 11.9.0-5.el10_2 | RHSA-2026:73765 |
| RHEL 9 | pki-core +8 | 11.7.1-2.el9_8 | RHSA-2026:73766 |
| RHEL 8 | jss +2 | 4.11.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2026:75573 |
| RHEL 8 | ldapjdk +2 | 4.24.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2026:75573 |
| RHEL 8 | pki-core +9 | 10.15.1-3.module+el8.10.0+24994+a709cca8 | RHSA-2026:75573 |
| RHEL 8 | resteasy +1 | 3.0.26-7.module+el8.10.0+21132+79720f4e | RHSA-2026:75573 |
| RHEL 8 | tomcatjss +1 | 7.8.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2026:75573 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | idm-pki-ca +7 | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux 9 | idm-pki-ca +7 | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux 8 | idm-jss +1 | 4.11.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2026:75573 |
| AlmaLinux 8 | idm-ldapjdk +1 | 4.24.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2026:75573 |
| AlmaLinux 8 | idm-pki-ca +8 | 10.15.1-3.module_el8.10.0+4298+2330dc61 | ALSA-2026:75573 |
| AlmaLinux 8 | idm-tomcatjss | 7.8.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2026:75573 |
| AlmaLinux 8 | resteasy +1 | 3.0.26-7.module_el8.10.0+4273+d9f1a83b | ALSA-2026:75573 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dogtag-pki | 11.9.0-5.el10_2.rocky.0.1 | RLSA-2026:73765 |
| Rocky Linux 9 | pki-core | 11.7.1-2.el9_8 | RLSA-2026:73766 |
| Rocky Linux 8 | jss | 4.11.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2026:75573 |
| Rocky Linux 8 | ldapjdk | 4.24.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2026:75573 |
| Rocky Linux 8 | resteasy | 3.0.26-7.module+el8.10.0+1767+f923f786 | RLSA-2026:75573 |
| Rocky Linux 8 | tomcatjss | 7.8.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2026:75573 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | idm-pki-ca +7 | 11.9.0-5.0.1.el10_2 | ELSA-2026-73765 |
| Oracle Linux 9 | idm-pki-ca +7 | 11.7.1-2.0.1.el9_8 | ELSA-2026-73766 |
| Oracle Linux 8 | idm-jss +1 | 4.11.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2026-75573 |
| Oracle Linux 8 | idm-ldapjdk +1 | 4.24.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2026-75573 |
| Oracle Linux 8 | idm-pki-ca +8 | 10.15.1-3.0.1.module+el8.10.0+91058+3f9a8c26 | ELSA-2026-75573 |
| Oracle Linux 8 | idm-tomcatjss | 7.8.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2026-75573 |
| Oracle Linux 8 | resteasy +1 | 3.0.26-7.module+el8.10.0+90362+5113f0b5 | ELSA-2026-75573 |
Advisories 13
- WID-SEC-2026-3662 Red Hat Enterprise Linux (pki-core und dogtag-pki): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026
- ALSA-2026:73766 Important: pki-core security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:73765 Important: dogtag-pki security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75573 Important: pki-core:10.6 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:75573 Red Hat Security Advisory: pki-core:10.6 security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:73765 Red Hat Security Advisory: dogtag-pki security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:73766 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RLSA-2026:75573 Important: pki-core:10.6 security update Rocky Linux Security Advisories · Oct 5, 2026
- ELSA-2026-75573 Important: pki-core:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 5, 2026
- RLSA-2026:73765 Important: dogtag-pki security update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:73766 Important: pki-core security update Rocky Linux Security Advisories · Oct 1, 2026
- ELSA-2026-73765 Important: dogtag-pki security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ELSA-2026-73766 Important: pki-core security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
References
- RHSA-2026:73765 vendor-advisory
- RHSA-2026:73766 vendor-advisory
- RHSA-2026:75573 vendor-advisory
- RHSA-2026:86621 vendor-advisory
- RHSA-2026:86623 vendor-advisory
- RHSA-2026:86624 vendor-advisory
- RHSA-2026:86625 vendor-advisory
- RHSA-2026:93668 vendor-advisory
- RHSA-2026:95097 vendor-advisory
- RHSA-2026:95181 vendor-advisory
- RHSA-2026:95182 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-76561 vdb-entry
- RHBZ#2519523 issue-tracking