EUVD-2026-51078
GHSA-g3fm-cr7x-pwvj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Network-reachable ACME endpoint requires no credentials; scope changes because the server pivots to internal networks; confidentiality limited to partial HTTP response disclosure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
AnalysisAI
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Dogtag PKI ACME responder subsystem is enabled and reachable by the attacker - it is not enabled by default in all deployments, so organizations that have not configured ACME are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.8 (Medium) is driven primarily by the Scope:Changed metric, which captures the key risk: the Dogtag server crosses a security boundary by making network requests on behalf of the attacker, potentially reaching services that are otherwise isolated from external access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers an ACME account with the target Dogtag PKI instance - an operation requiring no prior credentials - then submits an HTTP-01 challenge order specifying an IP address literal (e.g., 192.168.1.1) or a domain that redirects to an internal address as the identifier. The Dogtag ACME responder issues an outbound HTTP GET to the attacker-controlled target, probing an internal service such as a cloud metadata endpoint or internal management API. … |
| Remediation | No vendor-released patch version has been independently confirmed from the available reference data; organizations should monitor https://access.redhat.com/security/cve/CVE-2026-18369 and apply any errata released by Red Hat as soon as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today