What’s Vulnerable › Vulnerabilities

CVE-2026-18047: Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-28 · updated 2026-07-28
• Weakness: CWE-288

Description

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

Affected products

• Red Hat Certificate System 10: all versions
• Red Hat Certificate System 11: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-18047
• https://bugzilla.redhat.com/show_bug.cgi?id=2507956

Get alerted when CVE-2026-18047 or the next vulnerability affects your stack