CVE-2026-80110: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-80110 is an incorrect authorization vulnerability in Red Hat's pki-core (Dogtag PKI) affecting the v2 REST ACL filter. The flaw allows authenticated Certificate Manager Agents to invoke the administrator-only raw profile creation endpoint (POST /v2/profiles/raw) by exploiting a lexicographic tie-breaking bug in ACL key resolution. Affected products include dogtag-pki and pki-core:10.6/pki-core (specifically confirmed in pki-core 11.6.0 and 11.7.1 on RHEL 9); the older pki-core 10.x line (RHEL 7/8) is not affected. The vulnerability was reported on August 25, 2026, and publicly disclosed on September 21, 2026, with a CVSS v3.1 base score of 8.1 (High) (Red Hat Advisory, Github Advisory).

The root cause is CWE-863 (Incorrect Authorization) in the org.dogtagpki.server.rest.v2.filters.ACLFilter class, which resolves ACL permissions by selecting the lexicographically largest matching key via Comparator.reverseOrder().findFirst() rather than the most specific match (Red Hat Bugzilla). Because the wildcard placeholder character { (0x7B) sorts above lowercase ASCII letters, the wildcard key POST:{} (mapped to profiles.approve) beats the literal key POST:raw (mapped to profiles.create) when both match a request to POST /v2/profiles/raw. Critically, sibling filters (PKIServlet's dispatcher and AuthMethodFilter) use Comparator.naturalOrder() and correctly select the literal match — only ACLFilter's independent tie-break disagrees. No non-default configuration is required; the v2 REST API is network-reachable in standard IdM/RHCS deployments via the ipa-pki-proxy.conf reverse-proxy configuration (Red Hat Bugzilla).

A successful exploit allows an authenticated Certificate Manager Agent — a non-administrative role — to author and activate an arbitrary certificate-issuance profile by calling createProfileRaw with an attacker-supplied raw byte stream, then enabling it using their legitimate profiles.approve permission. This constitutes a privilege escalation from the CA Agent role to effective control over the CA's issuance policy, directly compromising the integrity of certificate issuance and posing a confidentiality risk to all relying parties that trust certificates issued by the affected CA. Availability is not impacted, but the integrity and confidentiality impacts are rated High (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Red Hat Advisory). The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an existing authenticated credential in the Certificate Manager Agents role, making it non-automatable and reducing its immediate risk compared to unauthenticated vulnerabilities. The vulnerability was discovered and reported by Arpit Jain (GitHub: arpitjain099) (Red Hat Advisory).

1. Obtain Certificate Manager Agent credentials: Acquire valid credentials for an account in the Certificate Manager Agents group on the target Dogtag PKI / pki-core 11.x deployment (e.g., through phishing, credential theft, or insider access).
2. Identify the target endpoint: Confirm the target is running pki-core 11.6.0 or 11.7.1 on RHEL 9 with the v2 REST API accessible (typically via the ipa-pki-proxy.conf reverse proxy).
3. Craft a malicious profile payload: Prepare a raw certificate profile byte stream defining an attacker-controlled issuance policy (e.g., a profile that issues certificates with elevated privileges or for unauthorized subjects).
4. Send the unauthorized POST request: Authenticate to the CA's REST API and submit POST /v2/profiles/raw with the crafted payload. Due to the ACL tie-breaking bug, the request is authorized under profiles.approve instead of the required profiles.create, bypassing the Administrator-level restriction (Red Hat Bugzilla).
5. Activate the profile: Use the legitimate profiles.approve permission to enable the newly created profile, making it active for certificate issuance.
6. Abuse the issuance policy: Issue certificates under the attacker-defined profile to gain unauthorized access to systems or services that trust the CA.

• Network: Unexpected POST requests to /v2/profiles/raw originating from Certificate Manager Agent accounts (rather than Administrator accounts); monitor CA reverse-proxy logs (e.g., ipa-pki-proxy.conf access logs) for this pattern.
• Logs: Dogtag PKI audit logs (/var/log/pki/) showing createProfileRaw operations attributed to non-Administrator principals; profile creation events (PROFILE_CREATION) associated with Certificate Manager Agent identities.
• Application State: Newly created or recently modified certificate profiles not authorized by an Administrator; profiles with unusual or unexpected policy configurations in the CA's profile store.
• File System: New or modified profile configuration files in the PKI profile directory (e.g., /var/lib/pki/<instance>/ca/profiles/ca/) with timestamps inconsistent with administrative activity.

Red Hat states there is no configuration-based mitigation other than applying an update once available (Red Hat Advisory). As a partial mitigation, administrators should restrict membership in the Certificate Manager Agents group to only fully trusted users, since exploitation requires an authenticated credential in that role. Organizations should also audit recent POST /v2/profiles/raw activity and review all certificate profiles for unauthorized changes. Monitor the Red Hat advisory page for patch availability and apply updates as soon as they are released.

Red Hat classified the vulnerability as 'Important' (not Critical), noting that while it enables significant privilege escalation within the CA, it requires an existing authenticated credential rather than unauthenticated remote code execution (Red Hat Advisory). The vulnerability was acknowledged by Red Hat Product Security with credit to the reporter Arpit Jain. Brief mentions appeared on security aggregator platforms including Mastodon (RedPacketSecurity) and vulnerability tracking services shortly after disclosure.