103 matches found
CVE-2026-76561
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
EUVD-2026-72654
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
CVE-2026-76561 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
CVE-2026-76561
CVE-2026-76561 affects Dogtag PKI (pki-core), the certificate authority component used by FreeIPA . The certificate profile import functionality fails to fully validate uploaded profile content beyond the profile ID, allowing an authenticated user with CA Administrator privileges to exploit the E...
CVE-2026-76561
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
PT-2026-87000
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
CVE-2026-53682 Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...
CVE-2026-53682
Dogtag PKI (pki-core) exposes the Security Domain hosts inventory via the REST endpoint GET /ca/rest/securityDomain/hosts without requiring authentication (no principal, client certificate, or session). An unauthenticated client can receive a structured response enumerating internal PKI/CA hosts ...
CVE-2026-11873 Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...
CVE-2026-11873
Red Hat IdM (Identity Management) exposes an Apache-proxied Dogtag CA REST endpoint (POST /ca/rest/certrequests ) that, upon receiving an unauthenticated malformed or empty request, returns an HTTP 500 response containing internal Java stack traces . The same unauthenticated error path writes lar...
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369 Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369
Removed by vendor...
CVE-2026-18369
Dogtag PKI’s ACME responder is vulnerable: the HTTP-01 validator accepts IP literal identifiers and follows redirects without validating public-facing targets, enabling unauthenticated ACME accounts to induce SSRF to internal services. With the InMemory database backend, the internal target respo...
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
EUVD-2026-51078
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18047
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...
CVE-2026-18047 Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...
