Junglewise Threat Intelligence

CVE-2026-17039: Red Hat pki-core authorization bypass in certificate renewal

CVE-2026-17039 · Severity: low · CVSS 3.1 · Published 2026-07-24

Technologies: Red Hat Enterprise Linux. Vendors: Red Hat.

Executive brief

A security flaw was found in the Dogtag PKI certificate management system, which is used to manage digital identities and secure communications. An authenticated user can renew a certificate belonging to a different security group (realm) without proper authorization. While this allows unauthorized certificate renewals, it does not expose private keys or allow an attacker to disrupt the original certificate owner's services.

Technical details

An authorization bypass vulnerability exists in the RenewalProcessor component of pki-core (Dogtag PKI). While the enrollment path correctly implements realm-based authorization checks via AuthzSubsystem.checkRealm(), the renewal path omits this check despite being reachable through the same REST endpoints. An authenticated attacker with access to one realm can submit a renewal request for a certificate serial number belonging to a different realm by setting a client-controlled 'isRenewal' flag. This causes the request to be processed and submitted to the victim realm's queue without consulting its authorization manager. The impact is limited to unauthorized renewal; it does not provide access to private keys or enable denial-of-service against the original certificate.

Affected products

  • Red Hat pki-core 9
  • Red Hat dogtag-pki 10, 11.9.0
  • Red Hat redhat-pki 10, 11, 11.10.0
  • Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10

Timeline

  • 2026-07-24: advisory: Advisory published by Red Hat and NVD
  • 2016-05-09: other: Vulnerability introduced in commit e2de26769761af04b9c56071bd1a1926903c49b6

References