EUVD-2026-51078
GHSA-g3fm-cr7x-pwvj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Network-reachable ACME endpoint requires no credentials; scope changes because the server pivots to internal networks; confidentiality limited to partial HTTP response disclosure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
AnalysisAI
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Dogtag PKI is the open-source PKI subsystem underlying Red Hat Certificate System versions 9, 10, and 11. The ACME HTTP-01 challenge mechanism requires the server to issue an outbound HTTP GET to a URL controlled by the certificate requestor in order to validate domain ownership. CWE-918 (Server-Side Request Forgery) arises here from two distinct validation failures: the ACME responder does not reject IP address literals when they appear as DNS-form identifiers (violating RFC 8555 §8.3), and it follows HTTP 3xx redirects without filtering the redirect target against a public IP allowlist. Combined, these allow an attacker to supply an IPv4/IPv6 literal or engineer a redirect chain terminating at an RFC 1918 or loopback address. The InMemory ACME database backend exacerbates the issue by surfacing the raw HTTP response body in challenge error responses, converting a blind SSRF into a semi-authenticated internal data-disclosure channel. Affected CPEs span cpe:2.3:a:red_hat:red_hat_certificate_system_9 through _11 and the associated RHEL 6 through 10 platform packages.
RemediationAI
No vendor-released patch version has been independently confirmed from the available reference data; organizations should monitor https://access.redhat.com/security/cve/CVE-2026-18369 and apply any errata released by Red Hat as soon as available. As immediate compensating controls, if the ACME subsystem is not operationally required, disabling the Dogtag ACME responder entirely eliminates the attack surface at the cost of losing automated certificate issuance workflows. If ACME must remain active, deploying egress firewall rules on the host running Dogtag PKI to block outbound HTTP/HTTPS connections to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) ranges will mitigate the SSRF pivot, though it does not address the underlying validation flaw. Organizations using the InMemory ACME database backend should prioritize switching to a persistent backend (e.g., LDAP) as an additional measure to prevent response body disclosure, accepting the operational cost of backend configuration changes.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today