EUVD-2026-48615
GHSA-jq46-23h4-vfpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CA system
-
DeliveryIdentify target certificate serial from another realm
-
ExploitSend renewal request for that certificate
-
ExecutionCertificate renewed without realm authorization
-
ImpactUnauthorized certificate validity extension
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have an active, authenticated session in the Certificate System (e.g., as a user of realm A) and must know the serial number or certificate ID of a target certificate belonging to a different realm. The CA renewal HTTP endpoint must be network-accessible. The attack complexity is high (CVSS AC:H) because the attacker needs to discover a valid cross-realm certificate identifier; no additional authentication or configuration is required beyond a standard authenticated user account. The attack is limited to integrity impact (unauthorized renewal) and does not allow disclosure of certificate data or denial of service. |
| Impact | CVSS 3.1 base score 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-attackable but high complexity, low privileges required, and only low integrity impact. EPSS score is 0.21% (low probability), and CISA's SSVC framework rates exploitation as 'none', not automatable, with partial technical impact. No KEV listing exists. The low CVSS and EPSS scores align with SSVC's assessment that this is not an actively exploited or easily automatable threat. The primary risk is unauthorized certificate renewal, which could undermine trust boundaries in multi-tenant deployments, but the attack requires authenticated access and knowledge of a target certificate-limiting real-world exploitability. |
| Exploit ScenarioDerived | An authenticated user of realm A (e.g., an internal employee) sends a crafted renewal request for a certificate originally issued to realm B, using the certificate's serial number or ID. Because the renewal servlet lacks realm validation, the certificate is renewed without authorization from realm B's administrators, potentially extending its validity in an unauthorized manner. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
RemediationAI
Apply the upstream commit e2de26769761af04b9c56071bd1a1926903c49b6, which adds realm-based authorization checks to the EnrollmentProcessor (and by extension the renewal path). Upgrade to a patched version of Red Hat Certificate System once Red Hat releases an official update for the affected versions (9, 10, 11). If immediate patching is not possible, restrict network access to the CA renewal endpoint to trusted users only, or monitor renewal audit logs for cross-realm requests as a compensating control. No workaround that fully mitigates the vulnerability without code changes is known.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in pki-core, the underlying PKI framework used by Red Hat Certificate System. Certificate enrollment normally includes an authorization step that validates the requesting user's realm against the certificate's realm. The renewal path (handled by RenewalProcessor.java) omits this check, allowing a user authenticated in one realm to trigger renewal of a certificate from another realm. CPE data confirms affected versions: Red Hat Certificate System 9, 10, 11 and Red Hat Enterprise Linux 6 through 10. The root cause class is CWE-863 (Incorrect Authorization), as the renewal servlet fails to enforce the same realm check present in the enrollment servlet.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network attack vector, high complexity due to need for known certificate identifier, low privilege required, no user interaction, low integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB