{"id":"CVE-2026-17039","state":"PUBLISHED","title":"Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path","description":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.","publishedAt":"2026-07-24T15:12:57.863Z","updatedAt":"2026-07-25T00:53:43.085Z","severity":{"score":3.1,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Certificate System 10","Red Hat Red Hat Certificate System 11","Red Hat Red Hat Certificate System 9","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9"],"affected":[{"vendor":"Red Hat","product":"Red Hat Certificate System 10","packageName":"redhat-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:10"]},{"vendor":"Red Hat","product":"Red Hat Certificate System 11","packageName":"redhat-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:11"]},{"vendor":"Red Hat","product":"Red Hat Certificate System 9","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dogtag-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":["https://access.redhat.com/security/cve/CVE-2021-20179","https://access.redhat.com/security/cve/CVE-2026-17039","https://bugzilla.redhat.com/show_bug.cgi?id=2506720","https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif","https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java","https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java","https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.java","https://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/17xxx/CVE-2026-17039.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-17039","state":"PUBLISHED","datePublished":"2026-07-24T15:12:57.863Z","dateUpdated":"2026-07-25T00:53:43.085Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-07-24T12:43:53.156Z"},"containers":{"cna":{"title":"Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path","descriptions":[{"lang":"en","value":"A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Certificate System 10","packageName":"redhat-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:10"]},{"vendor":"Red Hat","product":"Red Hat Certificate System 11","packageName":"redhat-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:11"]},{"vendor":"Red Hat","product":"Red Hat Certificate System 9","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dogtag-pki","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-core","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2021-20179"},{"url":"https://access.redhat.com/security/cve/CVE-2026-17039","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506720","name":"RHBZ#2506720","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif"},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java"},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java"},{"url":"https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.java"},{"url":"https://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-07-24T15:12:57.863Z"},"datePublic":"2026-07-24T00:00:00.000Z","x_redhatCweChain":"CWE-863: Incorrect Authorization","workarounds":[{"lang":"en","value":"Deployments that do not configure a realm-mapped authorization manager (AuthzRealmDefault with a non-default realm-to-authorization-manager mapping) for multi-tenant or delegated sub-CA use are not exposed to this issue. For deployments that do use realm-based authorization, using a renewal profile that additionally restricts renewal requests to the original requester narrows exposure: the shipped caDirUserRenewal.cfg profile configures authz.acl=user_origreq=\"auth_token.uid\", which independently blocks cross-user renewal by comparing the renewing caller's UID against the UID that submitted the original request. This is a partial mitigation only -- it is realm-blind rather than realm-aware, so a UID collision across two independently-administered realms' user directories would still bypass it -- and it does not apply to caManualRenewal.cfg or other shipped renewal profiles that configure no authz.acl, which remain exploitable as described. No complete mitigation is available; apply the update once released."}],"timeline":[{"lang":"en","time":"2026-07-21T09:34:01.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-07-24T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Arpit Jain (Github: arpitjain099) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-25T00:53:34.296639Z","id":"CVE-2026-17039","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-25T00:53:43.085Z"}}]}}}