The Dogtag PKI ACME responder contains a flaw in its HTTP-01 challenge validation process. It incorrectly accepts IP address literals as DNS identifiers and follows HTTP redirects without confirming that the destination is a public address. This allows an unauthenticated attacker with an ACME account to exploit server-side request forgery (CWE-918), making the Dogtag server issue HTTP GET requests to internal network resources. Additionally, if the InMemory database backend is used, the attacker can retrieve the response content from these internal services through the ACME challenge error response. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope changed, and limited confidentiality impact.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks, causing the Dogtag server to access internal network services that are otherwise inaccessible. This can lead to information disclosure of internal service responses when the InMemory database backend is used. The confidentiality impact is limited to disclosure of response bodies; integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the ACME responder and monitor for unusual internal HTTP requests originating from the Dogtag server. Follow updates from the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18369 for remediation information.