Red Hat Certificate System EUVD-2026-69056

No authentication is required - the CVSS vector PR:N confirms exploitation without credentials, client certificate, or session token of any kind. The only prerequisite is network connectivity to the CA's HTTPS REST API port (typically 8443). The security domain feature must be active, meaning multiple PKI subsystems must be registered to a common security domain; this is the standard configuration for multi-subsystem RHCS deployments and not a non-default setting. Exploitation is limited to environments where the CA REST API port is reachable from untrusted networks - deployments that restrict this port to internal PKI management networks via firewall are not exposed. The vulnerability grants no write access, code execution, or access to cryptographic key material; it is purely topology information disclosure.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the constrained direct impact: network-accessible, trivially exploitable, but limited to partial confidentiality loss with no integrity or availability consequences. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. Despite the medium severity rating, the practical risk in hardened PKI environments should not be dismissed - exposing the full security domain topology reveals hostnames, port numbers, and subsystem roles that are valuable for targeted reconnaissance against CA infrastructure. Defenders should verify that the REST API port is not reachable from untrusted networks, as the attack requires only a basic HTTP client and is trivially automatable for reconnaissance. No POC has been identified. The absence of EPSS data is a gap; real-world exploitation probability cannot be independently estimated from available signals.

An attacker with network access to the RHCS CA's HTTPS port sends a single unauthenticated GET request to https://[ca-host]:[port]/ca/rest/securityDomain/hosts. The server responds with a structured payload enumerating all registered PKI subsystem hosts, their roles (CA, KRA, OCSP, etc.), and associated ports. The attacker uses this topology map to identify high-value internal targets - such as a KRA holding private key material - for subsequent exploitation. No exploit code or POC has been identified; a standard curl command suffices to trigger the disclosure.