Log in Start free

Vulnerability · Published Jul 30, 2026 · Assigned by redhat

CVE-2026-18369Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

Medium 5.8

In plain English

A medium-severity server-side request forgery in Red Hat Certificate System 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.4%top 67.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Certificate System 10.4 EUS for RHEL-8 see references
Red Hat Red Hat Certificate System 10 see references
Red Hat Red Hat Certificate System 11 see references
Red Hat Red Hat Certificate System 9 see references
Red Hat Red Hat Certificate System 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References