CVE-2026-80110: Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-21 · updated 2026-10-21
Weakness: CWE-863

Description

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:11.9.0-5.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:11.6.0-3.el10_0.1
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions — fixed in 0:11.7.1-2.el9_8
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:11.6.0-4.el9_6

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:11.9.0-5.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-3.el10_0.1; Red Hat Enterprise Linux 9 0:11.7.1-2.el9_8; Red Hat Enterprise Linux 9.6 Extended Update Support 0:11.6.0-4.el9_6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-80110 or the next vulnerability affects your stack