EUVD-2026-72654
GHSA-pp8g-7wxg-9php
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CA Administrator authentication required (PR:H); network-accessible interface (AV:N); full code execution as pkiuser yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.
AnalysisAI
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated CA Administrator account within Dogtag PKI - this is PR:H per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the constraint that CA Administrator credentials are required (PR:H), which substantially narrows the attack surface compared to unauthenticated vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply vendor-released patches via standard Red Hat subscription channels (yum/dnf update dogtag-pki or ipa) once Red Hat publishes an RHSA for this CVE - the fix version is not independently confirmed from the provided references; monitor https://access.redhat.com/security/cve/CVE-2026-76561 for the official errata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dogtag PKI and Red Hat Certificate System 9 deployments on RHEL 6-10 and immediately restrict certificate profile import access to a minimal set of essential CA administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today