Bug 2545316 (CVE-2026-104988)

Summary: CVE-2026-104988 pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aakkiang, cfu, edewata, gkimetto, jmagne, mfargett, prisingh, rhel-process-autobot, skhandel, snegrini, taherrin, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 19:08:22 UTC 
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. In this scenario, the SSL_CLIENT_CERT session attribute retains the EST subsystem's own agent certificate instead of being replaced by the end-user's certificate. The parent CMCAuth.verifySignerInfo() then compares the CMC signer's Subject DN against this agent certificate using DER byte comparison, which passes if the attacker crafts a self-signed certificate with a DER-matching Subject DN. The signer certificate's trust chain is not validated — verifySignerInfo() only verifies the CMC message signature against the bundled signer cert's own public key, which trivially passes since the attacker possesses the corresponding private key. Since CMCAuthForEST overrides authenticateCAUser() to skip CA user database verification, and RAHeaderClientCertSubjectNameConstraint sees the agent certificate in SSL_CLIENT_CERT and allows any subject name for agents, the CA issues a valid certificate with the attacker's requested arbitrary subject. An authenticated EST user with BasicAuth credentials can exploit this to obtain CA-signed certificates impersonating any entity.