Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-17039— Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

Quick assessment

Affected
Red Hat Red Hat Certificate System 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dogtag Certificate System Dogtag PKI是Dogtag Certificate System组织的一款公钥基础设施证书管理软件。 Dogtag Certificate System Dogtag PKI存在授权问题漏洞，该漏洞源于CA续订请求路径未执行基于领域的授权检查，允许已认证的用户（有权访问一个领域）导致属于不同领域的证书被续订而无需该领域的授权。

CVSS 3.1 · Low EPSS 0.26% · P16

Possible ATT&CK Techniques 1 AI

T1098 · Account Manipulation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17039

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Dogtag Certificate System Dogtag PKI 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dogtag Certificate System Dogtag PKI是Dogtag Certificate System组织的一款公钥基础设施证书管理软件。 Dogtag Certificate System Dogtag PKI存在授权问题漏洞，该漏洞源于CA续订请求路径未执行基于领域的授权检查，允许已认证的用户（有权访问一个领域）导致属于不同领域的证书被续订而无需该领域的授权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Certificate System 10 - cpe:/a:redhat:certificate_system:10
Red Hat Red Hat Certificate System 11 - cpe:/a:redhat:certificate_system:11
Red Hat Red Hat Certificate System 9 - cpe:/a:redhat:certificate_system:9
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9

II. Public POCs for CVE-2026-17039

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17039

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-17039 (4)

Vendor Advisories for CVE-2026-17039 (3)

Same Patch Batch · Red Hat · 2026-07-24 · 10 CVEs total

CVE-2026-17107 8.5 HIGH Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluste
CVE-2026-66337 6.5 MEDIUM Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_
CVE-2026-66339 6.5 MEDIUM Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization hea
CVE-2026-17059 6.5 MEDIUM Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypas
CVE-2026-17048 5.5 MEDIUM Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via adm
CVE-2026-16743 5.5 MEDIUM Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed us
CVE-2026-16730 5.5 MEDIUM Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
CVE-2026-16910 5.5 MEDIUM Quay: ssrf in red hat quay notification webhooks (slack/generic)
CVE-2026-66338 5.4 MEDIUM Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_in

IV. Related Vulnerabilities

Same product: Red Hat Certificate System 10
Same vendor: Red Hat
Same weakness: CWE-863

V. Comments for CVE-2026-17039

No comments yet

Leave a comment