Bug 2509234 (CVE-2026-18369)

Summary: CVE-2026-18369 dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aakkiang, cfu, edewata, gkimetto, jmagne, mfargett, prisingh, rhel-process-autobot, skhandel, snegrini, taherrin, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2509236    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-30 10:11:37 UTC 
A flaw was found in Dogtag PKI's ACME responder. The HTTP-01 challenge validator accepts IP address literals (e.g. 127.0.0.1) as dns identifiers without validating that the target address is public. Combined with the default Apache HttpClient behavior of following HTTP redirects, an unauthenticated ACME account holder can force the Dogtag server to send HTTP GET requests to arbitrary internal HTTP endpoints (loopback, link-local, RFC 1918, cloud metadata). When the InMemory database backend is used, the full HTTP response body of the internal target is included in the ACME challenge error and returned to the client, enabling the attacker to read internal HTTP responses. On DS/LDAP and PostgreSQL backends, the SSRF still occurs but the response body is only written to server logs, not returned to the client. The vulnerability exists because ACMEIdentifierValidator.validateSyntaxDNS() treats IP octets as valid DNS labels, ACMEPolicy.validateIdentifier() does not filter non-public addresses, and HTTP01Validator.getResponse() uses HttpClients.createDefault() which follows redirects without validating the destination address.