Dogtag CA EUVD-2026-69037

The Dogtag CA subsystem must be installed and running as part of an IdM deployment on RHEL 6-10; RHEL systems without IdM, or IdM configured with an external CA, are not affected. The POST /ca/rest/certrequests endpoint must be network-reachable by the attacker - typically via the Apache proxy on the IdM host. No authentication is required (CVSS PR:N) and no special configuration beyond a standard IdM-with-CA installation is needed. Exploitation of the log-amplification vector is limited by available disk space on the filesystem hosting /var/log/pki/; hosts with large log partitions or aggressive log rotation will absorb more traffic before impact materializes. Apache-layer rate limiting or WAF rules filtering the certrequests path would prevent the amplification vector but not the per-request stack trace disclosure.

The CVSS 6.5 Medium score reflects two distinct but coupled impact planes: AV:N/AC:L/PR:N/UI:N indicates a trivially reachable, unauthenticated attack surface, while C:L captures reconnaissance value from stack trace exposure and A:L captures service degradation from log amplification. Real-world priority is elevated relative to the raw score in IdM-heavy environments, because Dogtag CA is frequently on the critical path for Kerberos ticket issuance and LDAP certificate validation - a filled log partition that crashes the CA can cascade into authentication outages across the domain. The information disclosure component is lower urgency in isolation but supports follow-on attacks by exposing Java library versions and internal class structure. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; no CISA KEV listing exists, confirming no known active exploitation at time of analysis. No POC has been identified. The attack has no complexity barrier and is automatable, meaning that once discovered, the log-amplification vector could be scripted for sustained denial-of-service. CVSS correctly assigns no integrity impact (I:N), as the vulnerability involves only read/output paths with no state modification.

An unauthenticated attacker discovers an internet- or intranet-exposed IdM host and submits a high-rate stream of deliberately malformed POST bodies to /ca/rest/certrequests through the Apache proxy. Each request returns an HTTP 500 response carrying a full Java stack trace, which the attacker harvests to map internal library versions and class paths for targeted follow-on exploitation. Continued flooding fills the /var/log/pki/ filesystem partition, causing the Dogtag CA daemon to become unresponsive and disrupting Kerberos and LDAP certificate services for the entire IdM domain.