Dogtag PKI EUVD-2026-91777

Requires a valid, low-privileged EST user account (PR:L) and a Dogtag PKI / Red Hat Certificate System deployment with the EST subsystem enabled and the CMCAuthForEST authentication plugin in use. The attacker must submit an EST fullcmc enrollment request via BasicAuth while deliberately presenting no end-user TLS client certificate, so that the SSL_CLIENT_CERT attribute retains the EST agent certificate. Limiting factors: EST/fullcmc enrollment must be configured (not all PKI deployments expose EST), and the attacker must already hold EST enrollment credentials - this is a privilege escalation, not remote-unauthenticated access. No end-user client certificate or user interaction is required, which lowers the practical bar for an insider or any provisioned EST user.

This is a credible, actionable priority rather than a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) is internally consistent with the description: a network-reachable EST enrollment endpoint, low attack complexity (submit a fullcmc request over BasicAuth without a client cert), and low privileges (PR:L - any valid EST user account). The impact is severe and specific: an authenticated EST user escalates to agent-privileged certificate issuance and can mint CA-signed certificates with arbitrary subject names, which is effectively identity forgery across the entire PKI trust domain, justifying C:H/I:H. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation probability signals are absent - consistent with a freshly disclosed Red Hat-reported flaw. There is no conflict between the CVSS vector and the description. The one caveat: this is a privilege-escalation/authentication-bypass (fail-open) bug that requires an existing low-privileged EST account, so it is not remote-unauthenticated mass-exploitable; real-world risk is highest in environments that provision broad EST user access. The CWE-290 (authentication bypass by spoofing) classification matches the fail-open behavior described.

An authenticated EST user with only basic enrollment rights submits a fullcmc enrollment request over BasicAuth, deliberately omitting an end-user TLS client certificate. Because the SSL_CLIENT_CERT session attribute still holds the EST subsystem's own agent certificate, downstream authorization treats the request as agent-privileged, and the attacker is issued CA-signed certificates bearing arbitrary subject names (enabling impersonation of any identity). No public exploit code is identified in the provided data, but the attack requires no special tooling beyond a standard EST client.