Vulnerability · Published Oct 2, 2026 · Assigned by redhat

CVE-2026-104988Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject

High 8.1

In plain English

A high-severity authentication bypass by spoofing in Red Hat Certificate System 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Certificate System 10	see references
Red Hat	Red Hat Certificate System 11	see references
Red Hat	Red Hat Certificate System 9	see references
Red Hat	Red Hat Certificate System 9	see references
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-104988 vdb-entry, x_refsource_REDHAT
RHBZ#2545316 issue-tracking, x_refsource_REDHAT