CVE-2026-18047
MEDIUMDogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
Title source: cnaDescription
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.
References (2)
Core 2
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry
x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-18047
Issue Tracking, X_Refsource_Redhat issue-tracking
x_refsource_redhat
RHBZ#2507956
https://bugzilla.redhat.com/show_bug.cgi?id=2507956
Scores
CVSS v3
6.5
EPSS
0.0028
EPSS Percentile
20.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-288
Status
published
Products (8)
Red Hat/Red Hat Certificate System 10
Red Hat/Red Hat Certificate System 11
Red Hat/Red Hat Certificate System 9
Red Hat/Red Hat Enterprise Linux 10
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7
Red Hat/Red Hat Enterprise Linux 8
Red Hat/Red Hat Enterprise Linux 9
Published
Jul 28, 2026
Tracked Since
Jul 28, 2026