{"id":"CVE-2026-53682","aliases":["EUVD-2026-69056","GHSA-cvf8-gvvm-fg6c","UBUNTU-CVE-2026-53682"],"status":"published","title":"Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00209,"percentile":0.11161,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-284","CWE-497"],"published":"2026-09-01T12:37:50Z","modified":"2026-11-05T21:43:11Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.6-1","10.2.6-2","10.2.6-3","10.2.6+git20160317-1","10.2.6+git20160317-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.5+12-4ubuntu1","10.3.5+12-5","10.5.3-3","10.5.3-4","10.5.5-1","10.6.0~beta2-3","10.6.0-1ubuntu1","10.6.0-1ubuntu2","10.6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.7.3-4","10.8.3-1ubuntu1","10.8.3-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3build1","11.0.0-1","11.0.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat certificate system 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-53682","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487511","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53682"},{"url":"https://github.com/advisories/GHSA-cvf8-gvvm-fg6c"},{"url":"https://ubuntu.com/security/CVE-2026-53682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53682","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-53682","title":"Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","status":"published","published":"2026-09-01T12:37:50.827Z","modified":"2026-11-05T21:43:11.87Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497","CWE-200","CWE-284"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-69056","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","status":"published","published":"2026-09-01T12:37:50Z","modified":"2026-11-05T21:43:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T23:02:20.394374Z"}],"ghsa":[{"id":"GHSA-cvf8-gvvm-fg6c","title":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest...","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","status":"published","published":"2026-09-01T15:31:07Z","modified":"2026-09-23T15:31:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-497"],"updated_at":"2026-11-02T15:12:20.494129Z"}],"nvd":[{"id":"CVE-2026-53682","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","status":"published","published":"2026-09-01T13:19:47.067Z","modified":"2026-11-05T22:18:47.053Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-497","CWE-200","CWE-284"],"updated_at":"2026-11-05T23:57:20.366111Z"}],"osv":[{"id":"UBUNTU-CVE-2026-53682","description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","status":"published","published":"2026-09-01T13:19:00Z","modified":"2026-09-16T11:36:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"}]}}