Fedora Account System
Red Hat Associate
Red Hat Customer
FreeIPA's certprofile_import.pre_callback (ipaserver/plugins/certprofile.py) only extracts and validates the profileId field from an uploaded certificate profile; the remainder of the profile configuration is passed through unvalidated to Dogtag. Dogtag's ExternalProcessConstraint (base/ca/src/main/java/com/netscape/cms/profile/constraint/ExternalProcessConstraint.java) executes a configured binary with request-derived environment variables, giving a user who can import certificate profiles (a CA-Administrator-equivalent privilege) code execution as pkiuser. Independently reproduced against a stock freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install, using an administrator credential obtained via the companion FreeIPA takeover flaw: the certprofile-import -> ExternalProcessConstraint chain executed attacker-controlled commands. In the reference container, a further SSSD-cache-forging + ksu misconfiguration escalated this to full root — confirmed via a random-token file write, then read back through an independent channel to rule out fabricated output. Whether the root escalation applies to a genuine RHEL RPM-packaged IdM/PKI install (as opposed to being specific to the community container's SSSD/ksu configuration) has not yet been independently confirmed and needs follow-up before finalizing severity. This requires an already-authenticated CA-Administrator-equivalent account — it is not reachable anonymously on its own. Identified as part of the PSIRTSUPT-21812 investigation; see linked ticket for reproduction evidence.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:73765 https://access.redhat.com/errata/RHSA-2026:73765
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:73766 https://access.redhat.com/errata/RHSA-2026:73766
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:75573 https://access.redhat.com/errata/RHSA-2026:75573
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:86621 https://access.redhat.com/errata/RHSA-2026:86621
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:86625 https://access.redhat.com/errata/RHSA-2026:86625
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:86624 https://access.redhat.com/errata/RHSA-2026:86624
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:86623 https://access.redhat.com/errata/RHSA-2026:86623
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:93668 https://access.redhat.com/errata/RHSA-2026:93668
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:95097 https://access.redhat.com/errata/RHSA-2026:95097
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:95181 https://access.redhat.com/errata/RHSA-2026:95181
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:95182 https://access.redhat.com/errata/RHSA-2026:95182