Skip to content
Fencer Vulns
medium 6.5

CVE-2026-18047 json

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

published 2026-07-28 3 mo ago modified 2026-11-05 3 d ago also EUVD-2026-49793

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18047 updated cvss 6.5

dogtag-pki: pki-core: redhat-pki: pki: ACME admin enable/disable endpoint authentication bypass via trailing slash

  • Red Hat Certificate System 9 pki-core 10.5.18-32.el7pki, redhat-pki 11.10.0-1.el10_2
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Certificate System 10 redhat-pki 11.9.0-1.module+el8pki+24022+fc689657 Red Hat Certificate System 11 redhat-pki 11.10.0-1.el10_2
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 6 pki-ca, pki-util, pki-setup, pki-common, pki-silent, pki-symkey, +7 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-tools, pki-server, pki-symkey, +3 more Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-tools, idm-pki-ca, +13 more Red Hat Enterprise Linux 10 dogtag-pki 11.9.0-4.el10_2
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

  • Red Hat Red Hat Certificate System 10
  • Red Hat Red Hat Certificate System 11
  • Red Hat Red Hat Certificate System 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.