{"id":"CVE-2026-80110","aliases":["ALSA-2026:73765","ALSA-2026:73766","EUVD-2026-83919","GHSA-c24q-2g88-pp57","RHSA-2026:73765","RHSA-2026:73766","RLSA-2026:73765","RLSA-2026:73766","UBUNTU-CVE-2026-80110"],"status":"published","title":"Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00212,"percentile":0.11571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-09-21T14:05:16Z","modified":"2026-11-05T00:17:29Z","affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-5.el10_2.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"dogtag-pki-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"idm-pki-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"idm-pki-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-core-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-5.el10_2.rocky.0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pki-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.6-1","10.2.6-2","10.2.6-3","10.2.6+git20160317-1","10.2.6+git20160317-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.5+12-4ubuntu1","10.3.5+12-5","10.5.3-3","10.5.3-4","10.5.5-1","10.6.0~beta2-3","10.6.0-1ubuntu1","10.6.0-1ubuntu2","10.6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.7.3-4","10.8.3-1ubuntu1","10.8.3-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3build1","11.0.0-1","11.0.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"red hat","product":"red hat certificate system 9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:73765","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73766","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86621","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86623","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80110","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523749","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80110","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c24q-2g88-pp57"},{"url":"https://access.redhat.com/security/cve/CVE-2026-76561","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519523","tags":["report"]},{"url":"https://bugzilla.redhat.com/2523749","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-73765.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-73766.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519523","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73765.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76561","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76561","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80110","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73766.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:73765","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:73766","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-80110","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-80110","title":"Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","status":"published","published":"2026-09-21T14:05:16.656Z","modified":"2026-10-21T11:19:55.041Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:45:36.695039Z"}],"euvd":[{"id":"EUVD-2026-83919","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","status":"published","published":"2026-09-21T14:05:16Z","modified":"2026-10-21T11:19:55Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:39.717973Z"}],"ghsa":[{"id":"GHSA-c24q-2g88-pp57","title":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for...","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","status":"published","published":"2026-09-21T15:32:05Z","modified":"2026-10-21T12:31:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:14:09.061875Z"}],"nvd":[{"id":"CVE-2026-80110","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","status":"published","published":"2026-09-21T15:17:32.06Z","modified":"2026-11-05T00:17:29.897Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-05T01:45:11.243476Z"}],"osv":[{"id":"RHSA-2026:73765","title":"Red Hat Security Advisory: dogtag-pki security update","status":"published","published":"2026-10-01T10:21:01Z","modified":"2026-10-19T10:06:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:73766","title":"Red Hat Security Advisory: pki-core security update","status":"published","published":"2026-10-01T10:21:01Z","modified":"2026-10-19T10:06:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:73765","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments.  IdM PKI consists of the following components: \n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\nSecurity Fix(es):\n\n* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)\n\n* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-01T12:08:49.381512Z","modified":"2026-10-01T12:30:04.472375236Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:73766","title":"Important: pki-core security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.\n\nSecurity Fix(es):\n\n* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)\n\n* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-01T12:04:34.423174Z","modified":"2026-10-01T12:30:02.645330762Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-80110","description":"A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.","status":"published","published":"2026-09-21T15:17:00Z","modified":"2026-09-23T23:35:45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"ALSA-2026:73765","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:   \n\n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\n\nSecurity Fix(es):  \n\n  * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)\n  * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-29T11:30:49.467488468Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:73766","title":"Important: pki-core security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.  \n\nSecurity Fix(es):  \n\n  * pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)\n  * pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-29T11:32:37.625804175Z","updated_at":"2026-11-02T15:27:55.200553Z"}]}}