BIT-VAULT-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

EUVD-2026-94641

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

Security Bulletin: Vault PKI ACME Issues Certificate With Unvalidated SANs

Summary Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-105818: Insufficient Verification of Data Authenticity

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

PT-2026-107710

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.1.2 Vault Enterprise versions prior to 2.1.2 Vault Enterprise versions prior to 1.21.12 Vault Enterprise versions prior to 1.20.17 Vault Enterprise versions prior to 1.19.23 Description The PKI secre...

CVE-2026-40611

A flaw was found in lego, the Let's Encrypt client and ACME library written in Go. A malicious ACME Automated Certificate Management Environment server can exploit a path traversal vulnerability in the webroot HTTP-01 challenge provider. By supplying a specially crafted challenge token containing...

GHSA-QQX8-2XMM-JRV8 ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

Summary The webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego...

httpd:2.4 security update

httpd 2.4.37-43.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html. 2.4.37-43 - Related: 2007235 - CVE-2021-40438 httpd:2.4/httpd: modproxy: SSRF via a crafted request uri-path 2.4.37-42 - Resolves: 2007235 - CVE-2021-40438...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-41.0.1 - Add checks on the configured UDS path Orabug: 33412270CVE-2021-40438 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracles index page oracleindex.html 2.4.37-41 - Resolves: 1680111 - httpd sends reply to HTTPS GET using two TLS records -...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-13.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracles index page oracleindex.html 2.4.37-30 - Resolves: 1209162 - support logging to journald from CustomLog 2.4.37-29 - Resolves: 1823263 CVE-2020-1934 - CVE-2020-1934 httpd: modproxyftp use o...

mkcert: valid HTTPS certificates for localhost

or for any other names The web is moving to HTTPS, preventing network attackers from observing or injecting page contents. But HTTPS needs TLS certificates, and while deployment is increasingly a solved issue thanks to the ACME protocol and Let's Encrypt, development still mostly ends up happenin...

PT-2012-4621

Name of the Vulnerable Software and Affected Versions HP OpenVMS versions 7.3-2 through 8.4 on the Alpha platform HP OpenVMS versions 8.3 through 8.4 on the Itanium platform Description The issue is related to the improper implementation of the LOGIN and ACME SERVER ACMELOGIN programs, which allo...

PT-2012-4622

Name of the Vulnerable Software and Affected Versions HP OpenVMS versions 7.3-2 through 8.4 on the Alpha platform HP OpenVMS versions 8.3 through 8.4 on the Itanium platform Description The issue is related to the improper implementation of the LOGIN and ACME SERVER ACMELOGIN programs, which allo...

Acme.Server v1.7 of 13nov96 Directory Browsing

---------------------------------------------------------------------- Date: 31.05.2001 Affected Software: Acme.Serve v1.7 of 13nov96 http://www.acme.com Exploit: Browsing of directories and files allowed to unauthorized users Keywords: Cisco Secure Administration, Netscape FastTrack, ... Contact...