Skip to content
Fencer Vulns
medium 5.8

CVE-2026-18369 json

Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

published 2026-07-30 3 mo ago modified 2026-11-05 3 d ago also EUVD-2026-51078

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

Patch / fix

  • Red Hat Red Hat Certificate System 10.4 EUS for RHEL-8 8060020260814202723.07fb4edf
  • jss certificate system eus 10.4 4.9.11-1.module+el8pki+24697+be195eea
  • ldapjdk certificate system eus 10.4 4.23.0-1.module+el8pki+14677+1ef79a68
  • tomcatjss certificate system eus 10.4 7.7.4-1.module+el8pki+21738+33a5e23b
  • redhat-pki certificate system eus 10.4 10.13.14-1.module+el8pki+24697+be195eea
  • jss-javadoc certificate system eus 10.4 4.9.11-1.module+el8pki+24697+be195eea
  • redhat-pki-ca certificate system eus 10.4 10.13.14-1.module+el8pki+24697+be195eea
  • redhat-pki-est certificate system eus 10.4 10.13.14-1.module+el8pki+24697+be195eea
  • redhat-pki-kra certificate system eus 10.4 10.13.14-1.module+el8pki+24697+be195eea

red hat advisories RHSA-2026:67110

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18369 updated cvss 5.8

dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects

  • Red Hat Certificate System 9 pki-core, redhat-pki Red Hat Certificate System 10 redhat-pki Red Hat Certificate System 11 redhat-pki Red Hat Enterprise Linux 6 pki-ca, pki-core, pki-util, pki-setup, pki-common, pki-silent, +7 more Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more
    +2 more products
    Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +13 more Red Hat Enterprise Linux 10 dogtag-pki
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Certificate System 10.4 EUS for RHEL 8 jss 4.9.11-1.module+el8pki+24697+be195eea, ldapjdk 4.23.0-1.module+el8pki+14677+1ef79a68, tomcatjss 7.7.4-1.module+el8pki+21738+33a5e23b, jss-javadoc 4.9.11-1.module+el8pki+24697+be195eea, redhat-pki 10.13.14-1.module+el8pki+24697+be195eea, ldapjdk-javadoc 4.23.0-1.module+el8pki+14677+1ef79a68, +18 more
    fixed: vendor fix RHSA-2026:67110

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

  • Red Hat Red Hat Certificate System 10.4 EUS for RHEL-8
  • Red Hat Red Hat Certificate System 10
  • Red Hat Red Hat Certificate System 11
  • Red Hat Red Hat Certificate System 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.