Vulnerability · Published Sep 21, 2026 · Assigned by redhat
CVE-2026-80110Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint
High 8.1
In plain English
A high-severity incorrect authorization in Red Hat Certificate System 9 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | idm-pki-acme | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-acme | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-base | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-base | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-ca | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-ca | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-java | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-java | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-kra | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-kra | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-server | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-server | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | idm-pki-tools | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | idm-pki-tools | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| AlmaLinux:10 | python3-idm-pki | 11.9.0-5.el10_2.alma.1 | ALSA-2026:73765 |
| AlmaLinux:9 | python3-idm-pki | 11.7.1-2.el9_8 | ALSA-2026:73766 |
| Rocky Linux:10 | dogtag-pki | 0:11.9.0-5.el10_2.rocky.0.1 | RLSA-2026:73765 |
| Rocky Linux:9 | pki-core | 0:11.7.1-2.el9_8 | RLSA-2026:73766 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | see references |
| Red Hat | Red Hat Certificate System 9 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- RHSA-2026:73765 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:73766 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:86621 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:86623 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-80110 vdb-entry, x_refsource_REDHAT
- RHBZ#2523749 issue-tracking, x_refsource_REDHAT