Executive brief
A security vulnerability exists in Dogtag PKI, a system used for managing digital certificates and secure identities. An attacker can trick the server into making unauthorized requests to internal network services that are normally protected from the outside world. In certain configurations, this could allow the attacker to read sensitive information from internal systems, potentially exposing private data or cloud metadata.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Dogtag PKI ACME responder's HTTP-01 challenge validator. The flaw is caused by ACMEIdentifierValidator.validateSyntaxDNS() incorrectly accepting IP address literals as valid DNS identifiers and the HTTP01Validator following HTTP redirects without verifying if the target is a public address. An unauthenticated attacker can provide a loopback or internal IP address to force the server to send GET requests to internal endpoints. If the InMemory database backend is used, the full response body from the internal target is returned to the attacker via the ACME challenge error message; with LDAP or PostgreSQL backends, the response is only written to server logs.
Affected products
- Dogtag Dogtag PKI All versions using ACME responder
- Red Hat Red Hat Certificate System 9, 10, 11
- Red Hat Red Hat Enterprise Linux 6, 7, 8, 9, 10
Timeline
- 2026-07-30: disclosed: Vulnerability reported and published in NVD