Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104988— Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject

Quick assessment

Affected
Red Hat Red Hat Certificate System 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Dogtag PKI（pki-core）中发现了一个漏洞。CMCAuthForEST 身份验证插件在未通过基本认证（BasicAuth）提交包含终端用户 TLS 客户端证书的 EST fullcmc 注册请求时，会错误地允许访问（fail open）。此时，SSL_CLIENT_CERT 会话属性仍保留 EST 子系统的代理证书，导致下游授权检查将该请求误认为是具有代理特权的请求。经过身份验证的 EST 用户可以利用此漏洞，获取由 CA 签名的、具有任意主题名称的证书。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process

Affected Version Matrix 9

VendorProduct Version RangeStatus
Red Hat Red Hat Certificate System 10 any affected
Red Hat Red Hat Certificate System 11 any affected
Red Hat Red Hat Certificate System 9 any unaffected
any unaffected
Red Hat Red Hat Enterprise Linux 10 any affected
Red Hat Red Hat Enterprise Linux 6 any unaffected
Red Hat Red Hat Enterprise Linux 7 any unaffected
Red Hat Red Hat Enterprise Linux 8 any unaffected
Red Hat Red Hat Enterprise Linux 9 any unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104988

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Certificate System 10 - cpe:/a:redhat:certificate_system:10
Red Hat Red Hat Certificate System 11 - cpe:/a:redhat:certificate_system:11
Red Hat Red Hat Certificate System 9 - cpe:/a:redhat:certificate_system:9
Red Hat Red Hat Certificate System 9 - cpe:/a:redhat:certificate_system:9
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9

II. Public POCs for CVE-2026-104988

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104988

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104988 (2)

IV. Related Vulnerabilities

Same product: Red Hat Certificate System 10
Same vendor: Red Hat
Same weakness: CWE-290

V. Comments for CVE-2026-104988

No comments yet

Leave a comment