Critical Vulnerability in Dogtag PKI: Code Execution and Unauthorized Access Risks
Summary
RLSA-2026:73765: Important: dogtag-pki security update. Affects dogtag-pki versions < 0:11.9.0-5.el10_2.rocky.0.1. Fixed in 0:11.9.0-5.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dogtag PKI is an enterprise software system designed to manage Public Key Infrastructure (PKI) deployments. It includes components such as Certificate Authority (CA), Key Recovery Authority (KRA), Online Certificate Status Protocol (OCSP) Manager, Token Key Service (TKS), Token Processing Service (TPS), Automatic Certificate Management Environment (ACME) Responder, and Enrollment over Secure Transport (EST) Responder. The system is crucial for managing digital certificates and ensuring secure communications within organizations.
Vulnerability Detail
The vulnerability arises from two critical issues in the Dogtag PKI system. The first issue, identified as CVE-2026-76561, allows for code execution through unsanitized profile content during the certprofile-import process. This could lead to unauthorized execution of arbitrary code. The second issue, CVE-2026-80110, involves a reverse-lexicographic tie-break in the v2 REST ACL filter, which permits a CA Agent to invoke an admin-only endpoint for raw profile creation, potentially leading to unauthorized access and manipulation of sensitive data. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0:11.9.0-5.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update dogtag-pkiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected endpoints and limit the permissions of CA Agents until the package is updated. This can be done by modifying the access control lists (ACLs) in your PKI configuration.
Conclusion
The Dogtag PKI vulnerabilities present significant risks that could lead to unauthorized code execution and access to sensitive administrative functions. It is crucial to update to the patched version of the package to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for dogtag-pki →
FAQ
Dogtag PKI is an enterprise software system that manages Public Key Infrastructure (PKI) deployments, providing essential services for digital certificate management.
The vulnerabilities could lead to unauthorized code execution and access to sensitive administrative functions, potentially compromising the security of the entire PKI system.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, implement access restrictions and monitor your system closely for any suspicious activity as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2026-76561 and CVE-2026-80110, which provide insights into their impact and mitigation strategies.
References
Related vulnerabilities
Recent vulnerabilities recorded for dogtag-pki.
