CVE-2026-18369

Removed by vendor...

CVE-2026-18369 Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...

CVE-2026-18369

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...

CVE-2026-18369

Dogtag PKI’s ACME responder is vulnerable: the HTTP-01 validator accepts IP literal identifiers and follows redirects without validating public-facing targets, enabling unauthenticated ACME accounts to induce SSRF to internal services. With the InMemory database backend, the internal target respo...

CVE-2026-18369: Server-Side Request Forgery (SSRF)

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...

CVE-2026-18047

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...

CVE-2026-18047

Removed by vendor...

CVE-2026-18047

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...

CVE-2026-18047 Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...

CVE-2026-18047: Authentication Bypass Using an Alternate Path or Channel

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...

CVE-2026-48025: Improper Clearing of Heap Memory Before Release

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...

Linux Distros Unpatched Vulnerability : CVE-2026-17039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path...

CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

DEBIAN-CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

UBUNTU-CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

CVE-2026-17039 Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

CVE-2026-17039

Removed by vendor...

CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

EUVD-2026-48615

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

CVE-2026-17039

CVE-2026-17039 affects pki-core (Dogtag-pki / Red Hat pki). The CA renewal request path omits the realm-based authorization check that the enrollment path has, enabling an authenticated user with one realm to renew a certificate in another realm. The public CVSS v3.1 base score is 3.1 (LOW) with ...