Executive brief
Red Hat's pki-core is the certificate authority and key management component of the Dogtag PKI system used to issue and manage digital certificates. An authentication bypass flaw allows Certificate Manager Agents—a non-administrative role—to perform high-privilege certificate profile management operations that should be restricted to Administrators. An attacker with a Certificate Manager Agent credential could create or modify certificate issuance policies without authorization, compromising the integrity and trustworthiness of all certificates issued by the affected CA.
Technical details
The v2 REST ACL filter uses lexicographic string comparison to resolve collisions between literal and wildcard ACL permission mappings, allowing a wildcard permission to override a more specific literal permission. In the CA's profile-management REST API, this causes POST requests to /v2/profiles/raw to be authorized under the lower-privileged profiles.approve permission (held by Certificate Manager Agents) instead of the intended profiles.create permission (Administrator-only). The vulnerability requires an authenticated credential and affects the confidentiality and integrity of the certificate authority's issuance policy.
Affected products
- Red Hat pki-core
Timeline
- 2026-09-21: disclosed