Low severity · published Jul 24, 2026
CVE-2026-17039
Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Certificate System 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Certificate System 11 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Certificate System 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17039
access.redhat.com
https://access.redhat.com/security/cve/CVE-2021-20179
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-17039
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2506720
github.com
https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif
github.com
https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java
github.com
https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java
More from Red Hat Certificate System 10
8.1
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
7.5
CVE-2026-89059
Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
7.4
CVE-2026-89058
Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
6.5
CVE-2026-78323
Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
6.5
CVE-2026-18047
Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash