CVE-2026-17039

Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

3.1 Low

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.26%Unchanged since Jul 25, 2026

What each source reports

CVE List Score used 3.1

Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

Record: CVE-2026-17039
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-06

EUVDEUVD-2026-48615 3.1

Record: EUVD-2026-48615
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-06

GitHub AdvisoriesGHSA-jq46-23h4-vfpj 3.1

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not...

Record: GHSA-jq46-23h4-vfpj
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 3.1

Record: CVE-2026-17039
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-06

OSV 3.1

Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path

Record: CVE-2026-17039
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-07

OSVDEBIAN-CVE-2026-17039 3.1

Record: DEBIAN-CVE-2026-17039
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-17039 3.1

Record: UBUNTU-CVE-2026-17039
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`dogtag-pki` Debian:11	All versions, plus listed versions 10.10.2-310.10.6-111.0.0-111.0.3-111.0.3-2 Show 6 moreShow less 11.0.3-311.0.3-411.0.6-111.0.6-211.2.1-111.2.1-2	None known
`dogtag-pki` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 10.2.6-110.2.6-210.2.6-310.2.6+git20160317-110.2.6+git20160317-1ubuntu0.1~esm1	None known
`dogtag-pki` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 10.3.5+12-4ubuntu110.3.5+12-510.5.3-310.5.3-410.5.5-1 Show 4 moreShow less 10.6.0~beta2-310.6.0-1ubuntu110.6.0-1ubuntu210.6.0-1ubuntu2+esm1	None known
`dogtag-pki` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 10.7.3-410.8.3-1ubuntu110.8.3-1ubuntu1+esm1	None known
`dogtag-pki` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 10.10.2-3build111.0.0-111.0.0-1ubuntu0.1~esm1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts	EUVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-17039 is a low vulnerability (CVSS 3.1) in Red Hat Certificate System 10, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.

References

Show 9 moreShow less