CVE-2026-78323: Improper Certificate Validation in Red Hat Red Hat Certificate System 10

CVE-2026-78323 is a vulnerability in the JSSTrustManager class of JSS where it fails to verify NSS trust flags on CA certificates during validation. This allows certificates present in the NSS database without TRUSTED_CA flags to be trusted as TLS trust anchors. In configurations where certificate revocation checking is disabled (non-default), this could enable a man-in-the-middle attacker to forge certificates accepted by PKI client connections. The flaw is mitigated by default because certificate revocation verification (certChainRevokeVerify) is enabled by default on PKI client connections. The server-side TLS validation path using JSSNativeTrustManager is unaffected as it properly delegates to NSS native verification.

If exploited in non-default configurations where certificate revocation checking is disabled, an attacker could perform man-in-the-middle attacks by forging certificates accepted by PKI client connections. This could lead to confidentiality breaches. The flaw does not affect server-side TLS validation in default configurations. The overall impact is rated medium with high confidentiality impact, low integrity impact, and no availability impact.

This vulnerability is mitigated in default product configurations by the native certificate revocation verification check, which is enabled by default. Users should ensure that certificate revocation verification remains enabled (do not disable isCertRevocationVerify). No action is required for server-side TLS validation using the default TomcatJSS configuration, which uses the unaffected JSSNativeTrustManager. There is no vendor advisory indicating an official patch release yet; patch status is not confirmed. Users should monitor the vendor advisory for updates on fixes.