CVE-2026-18369: Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-30 · updated 2026-09-14
Weakness: CWE-918

Description

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

Affected products

Red Hat Certificate System 10: all versions
Red Hat Certificate System 10.4 EUS for RHEL-8: all versions — fixed in 8060020260814202723.07fb4edf
Red Hat Certificate System 11: all versions
Red Hat Certificate System 9: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

How to fix

Upgrade to a fixed version: Red Hat Certificate System 10.4 EUS for RHEL-8 8060020260814202723.07fb4edf. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-18369 or the next vulnerability affects your stack