Dogtag PKI CVE-2026-18369

Exploitation requires that the Dogtag PKI ACME responder subsystem is enabled and reachable by the attacker - it is not enabled by default in all deployments, so organizations that have not configured ACME are not exposed. The attacker must be able to register an ACME account with the server, which is the standard open-registration model of the ACME protocol and does not require prior credentials (aligning with PR:N in the CVSS vector). The full response-body disclosure condition requires the InMemory ACME database backend specifically; deployments using LDAP or other persistent backends reduce impact to blind SSRF. Exploitation does not require user interaction, specific client software, or elevated privileges on the attacking side. Limiting factors: PKI infrastructure is commonly deployed on internal networks with restricted external access, which reduces the realistic attacker population to internal users or those with VPN/network access.

The CVSS 3.1 base score of 5.8 (Medium) is driven primarily by the Scope:Changed metric, which captures the key risk: the Dogtag server crosses a security boundary by making network requests on behalf of the attacker, potentially reaching services that are otherwise isolated from external access. AV:N/AC:L/PR:N/UI:N signals that any party capable of registering an ACME account and submitting challenges can trigger this without special privileges or user interaction, making it broadly reachable. The confidentiality impact is rated Low (C:L) because SSRF in the general case provides limited data; however, when the InMemory backend is deployed, the effective confidentiality impact is higher than the base score suggests, as full HTTP response bodies are disclosed. No EPSS score was provided in the source data. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed active exploitation. Practically, this is a real and exploitable vulnerability for any organization running the ACME subsystem of Dogtag/Red Hat Certificate System with network exposure to untrusted parties - but the risk is bounded by the typically restricted deployment perimeter of PKI infrastructure.

An attacker registers an ACME account with the target Dogtag PKI instance - an operation requiring no prior credentials - then submits an HTTP-01 challenge order specifying an IP address literal (e.g., 192.168.1.1) or a domain that redirects to an internal address as the identifier. The Dogtag ACME responder issues an outbound HTTP GET to the attacker-controlled target, probing an internal service such as a cloud metadata endpoint or internal management API. If the InMemory backend is in use, the HTTP response body from the internal target is returned to the attacker in the ACME challenge error payload, completing the data exfiltration without requiring any further access.