{"id":"CVE-2026-17039","aliases":["DEBIAN-CVE-2026-17039","EUVD-2026-48615","GHSA-jq46-23h4-vfpj","UBUNTU-CVE-2026-17039"],"status":"published","title":"Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00259,"percentile":0.17705,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-07-24T15:12:57Z","modified":"2026-11-06T18:05:36Z","affected":[{"source":"osv","ecosystem":"Debian:11","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3","10.10.6-1","11.0.0-1","11.0.3-1","11.0.3-2","11.0.3-3","11.0.3-4","11.0.6-1","11.0.6-2","11.2.1-1","11.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.6-1","10.2.6-2","10.2.6-3","10.2.6+git20160317-1","10.2.6+git20160317-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.5+12-4ubuntu1","10.3.5+12-5","10.5.3-3","10.5.3-4","10.5.5-1","10.6.0~beta2-3","10.6.0-1ubuntu1","10.6.0-1ubuntu2","10.6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.7.3-4","10.8.3-1ubuntu1","10.8.3-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3build1","11.0.0-1","11.0.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat certificate system 10"},{"vendor":"red hat","product":"red hat certificate system 11"},{"vendor":"red hat","product":"red hat certificate system 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2021-20179","tags":["web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17039","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506720","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif","tags":["web","report"]},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java","tags":["web","report"]},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java","tags":["web","report"]},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.java","tags":["web","report"]},{"url":"https://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6","tags":["fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17039","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jq46-23h4-vfpj"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17039.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-17039","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-17039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17039","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-17039","title":"Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T15:12:57.863Z","modified":"2026-11-06T18:05:36.949Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T19:59:19.701997Z"}],"euvd":[{"id":"EUVD-2026-48615","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T15:12:57Z","modified":"2026-11-06T18:05:36Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T19:05:52.672747Z"}],"ghsa":[{"id":"GHSA-jq46-23h4-vfpj","title":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not...","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T18:31:25Z","modified":"2026-07-24T18:31:26Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:09:47.688482Z"}],"nvd":[{"id":"CVE-2026-17039","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T16:16:34.367Z","modified":"2026-11-06T19:17:46.157Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T22:02:12.917468Z"}],"osv":[{"id":"CVE-2026-17039","title":"Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T15:12:57.863Z","modified":"2026-11-08T02:47:21.783702099Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:02.245063Z"},{"id":"DEBIAN-CVE-2026-17039","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T16:16:34.367Z","modified":"2026-08-27T23:05:52.586030527Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"UBUNTU-CVE-2026-17039","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","status":"published","published":"2026-07-24T16:16:00Z","modified":"2026-07-29T07:53:23Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:00.592716Z"}]}}