Bug 2519523 (CVE-2026-76561)

FreeIPA's certprofile_import.pre_callback (ipaserver/plugins/certprofile.py) only extracts and validates the profileId field from an uploaded certificate profile; the remainder of the profile configuration is passed through unvalidated to Dogtag. Dogtag's ExternalProcessConstraint (base/ca/src/main/java/com/netscape/cms/profile/constraint/ExternalProcessConstraint.java) executes a configured binary with request-derived environment variables, giving a user who can import certificate profiles (a CA-Administrator-equivalent privilege) code execution as pkiuser.

Independently reproduced against a stock freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install, using an administrator credential obtained via the companion FreeIPA takeover flaw: the certprofile-import -> ExternalProcessConstraint chain executed attacker-controlled commands. In the reference container, a further SSSD-cache-forging + ksu misconfiguration escalated this to full root — confirmed via a random-token file write, then read back through an independent channel to rule out fabricated output. Whether the root escalation applies to a genuine RHEL RPM-packaged IdM/PKI install (as opposed to being specific to the community container's SSSD/ksu configuration) has not yet been independently confirmed and needs follow-up before finalizing severity.

This requires an already-authenticated CA-Administrator-equivalent account — it is not reachable anonymously on its own. Identified as part of the PSIRTSUPT-21812 investigation; see linked ticket for reproduction evidence.