Critical Vulnerability in pki-core:10.6 - Code Execution Risk via Unsanitized Profile Content
Summary
ALSA-2026:75573: Important: pki-core:10.6 security update. Affects idm-jss versions < 4.11.0-1.module_el8.10.0+3801+17b19a60. Fixed in 4.11.0-1.module_el8.10.0+3801+17b19a60. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Public Key Infrastructure (PKI) Core is a vital component of the AlmaLinux Certificate System, providing essential packages for managing digital certificates. It is designed to facilitate secure communications and identity verification within various applications. However, the PKI Core has been identified as vulnerable to a significant security flaw that could allow unauthorized code execution, thereby compromising the integrity of the system.
Vulnerability Detail
The vulnerability, identified as CVE-2026-76561, arises from the certprofile-import feature of the pki-core package. This feature fails to properly sanitize profile content, specifically the ExternalProcessConstraint, which can be exploited to execute arbitrary code. If successfully exploited, an attacker could gain unauthorized access to sensitive information or disrupt the normal operations of the system, leading to severe security breaches.
How To Fix
Minimum fixed version
4.11.0-1.module_el8.10.0+3801+17b19a60
This is the first release that contains the fix.
sudo dnf update idm-jssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to disable the certprofile-import feature until the packages can be updated. This can be done by modifying the configuration settings in the PKI Core to prevent the execution of unsanitized profile content.
Conclusion
The vulnerability in the pki-core package poses a significant risk due to its potential for code execution via unsanitized profile content. It is essential to update the affected packages promptly to safeguard your system against possible exploitation. Utilizing tools like Vulert can aid in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for idm-jss →
FAQ
CVE-2026-76561 is a security vulnerability in the pki-core package that allows code execution through unsanitized profile content.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized code execution, potentially compromising sensitive data and disrupting system operations.
Use the command 'sudo dnf update' followed by the names of the affected packages to update them to their patched versions.
Yes, updating to the patched versions of the affected packages is the permanent fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for idm-jss.
