EUVD-2026-48615
GHSA-jq46-23h4-vfpj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Network attack vector, high complexity due to need for known certificate identifier, low privilege required, no user interaction, low integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
AnalysisAI
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Technical ContextAI
The vulnerability resides in pki-core, the underlying PKI framework used by Red Hat Certificate System. Certificate enrollment normally includes an authorization step that validates the requesting user's realm against the certificate's realm. The renewal path (handled by RenewalProcessor.java) omits this check, allowing a user authenticated in one realm to trigger renewal of a certificate from another realm. CPE data confirms affected versions: Red Hat Certificate System 9, 10, 11 and Red Hat Enterprise Linux 6 through 10. The root cause class is CWE-863 (Incorrect Authorization), as the renewal servlet fails to enforce the same realm check present in the enrollment servlet.
RemediationAI
Apply the upstream commit e2de26769761af04b9c56071bd1a1926903c49b6, which adds realm-based authorization checks to the EnrollmentProcessor (and by extension the renewal path). Upgrade to a patched version of Red Hat Certificate System once Red Hat releases an official update for the affected versions (9, 10, 11). If immediate patching is not possible, restrict network access to the CA renewal endpoint to trusted users only, or monitor renewal audit logs for cross-realm requests as a compensating control. No workaround that fully mitigates the vulnerability without code changes is known.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today