A flaw was found in Dogtag PKI (pki-core). (CVE-2026-104988)
A vulnerability in Dogtag PKI (pki-core) allows an authenticated EST user to bypass intended authorization checks. The CMCAuthForEST authentication plugin fails open when processing EST fullcmc enrollment requests submitted via BasicAuth without an end-user TLS client certificate. This flaw causes the system to incorrectly treat the request as having agent-level privileges, enabling the user to obtain CA-signed certificates with arbitrary subject names.
AI Analysis
Technical Summary
CVE-2026-104988 describes a security flaw in Dogtag PKI's pki-core component, specifically in the CMCAuthForEST authentication plugin. When an EST fullcmc enrollment request is submitted using BasicAuth without an end-user TLS client certificate, the SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate. This retention causes downstream authorization checks to mistakenly grant agent-level privileges to the request. Consequently, an authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names, potentially undermining certificate issuance trust.
Potential Impact
An authenticated EST user can exploit this vulnerability to obtain CA-signed certificates with arbitrary subject names. This could allow unauthorized certificate issuance, potentially enabling impersonation or unauthorized access within systems relying on Dogtag PKI for certificate management. The vulnerability has a high severity rating with a CVSS score of 8.1, indicating significant confidentiality and integrity impacts but no availability impact.
Mitigation Recommendations
No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict EST user authentication methods or monitor certificate issuance closely to detect anomalous requests. Avoid using BasicAuth without client TLS certificates for EST fullcmc enrollment requests if possible.
A flaw was found in Dogtag PKI (pki-core). (CVE-2026-104988)
Description
A vulnerability in Dogtag PKI (pki-core) allows an authenticated EST user to bypass intended authorization checks. The CMCAuthForEST authentication plugin fails open when processing EST fullcmc enrollment requests submitted via BasicAuth without an end-user TLS client certificate. This flaw causes the system to incorrectly treat the request as having agent-level privileges, enabling the user to obtain CA-signed certificates with arbitrary subject names.
CVSS v3.1
Score 8.1high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104988 describes a security flaw in Dogtag PKI's pki-core component, specifically in the CMCAuthForEST authentication plugin. When an EST fullcmc enrollment request is submitted using BasicAuth without an end-user TLS client certificate, the SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate. This retention causes downstream authorization checks to mistakenly grant agent-level privileges to the request. Consequently, an authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names, potentially undermining certificate issuance trust.
Potential Impact
An authenticated EST user can exploit this vulnerability to obtain CA-signed certificates with arbitrary subject names. This could allow unauthorized certificate issuance, potentially enabling impersonation or unauthorized access within systems relying on Dogtag PKI for certificate management. The vulnerability has a high severity rating with a CVSS score of 8.1, indicating significant confidentiality and integrity impacts but no availability impact.
Mitigation Recommendations
No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict EST user authentication methods or monitor certificate issuance closely to detect anomalous requests. Avoid using BasicAuth without client TLS certificates for EST fullcmc enrollment requests if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qgmm-v3v3-wff2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-104988"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac139baa43b0b3b89d69d40
Added to database: 10/03/2026, 17:22:02 UTC
Last enriched: 10/03/2026, 17:42:33 UTC
Last updated: 10/04/2026, 04:45:56 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.