{"id":"CVE-2026-104988","aliases":["EUVD-2026-91777","GHSA-qgmm-v3v3-wff2","UBUNTU-CVE-2026-104988"],"status":"published","title":"Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00204,"percentile":0.10469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-10-02T19:34:33Z","modified":"2026-11-04T21:41:10Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.6-1","10.2.6-2","10.2.6-3","10.2.6+git20160317-1","10.2.6+git20160317-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.5+12-4ubuntu1","10.3.5+12-5","10.5.3-3","10.5.3-4","10.5.5-1","10.6.0~beta2-3","10.6.0-1ubuntu1","10.6.0-1ubuntu2","10.6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.7.3-4","10.8.3-1ubuntu1","10.8.3-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3build1","11.0.0-1","11.0.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat certificate system 10"},{"vendor":"red hat","product":"red hat certificate system 11"},{"vendor":"red hat","product":"red hat certificate system 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104988","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545316","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104988"},{"url":"https://github.com/advisories/GHSA-qgmm-v3v3-wff2"},{"url":"https://ubuntu.com/security/CVE-2026-104988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104988","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-104988","title":"Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","status":"published","published":"2026-10-02T19:34:33.328Z","modified":"2026-11-04T21:41:10.255Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2026-91777","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","status":"published","published":"2026-10-02T19:34:33Z","modified":"2026-11-04T21:41:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-qgmm-v3v3-wff2","title":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","status":"published","published":"2026-10-02T21:32:06Z","modified":"2026-10-02T21:32:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:12:43.646433Z"}],"nvd":[{"id":"CVE-2026-104988","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","status":"published","published":"2026-10-02T20:17:01.37Z","modified":"2026-11-04T22:17:45.307Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-04T23:43:40.301794Z"}],"osv":[{"id":"UBUNTU-CVE-2026-104988","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","status":"published","published":"2026-10-02T20:17:00Z","modified":"2026-10-08T09:54:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"}]}}