The vulnerability in Red Hat Certificate System 10's Dogtag PKI ACME responder arises because the HTTP-01 challenge validator accepts IP address literals as DNS identifiers and follows HTTP redirects without validating that the destination is a public address. This flaw enables unauthenticated attackers with an ACME account to perform SSRF attacks, causing the server to send HTTP GET requests to internal network services. Additionally, with the InMemory database backend, the attacker can obtain the response body of these internal requests through the ACME challenge error response, leading to information disclosure.

An unauthenticated attacker can exploit this vulnerability to induce the Dogtag server to make HTTP requests to internal network services, potentially accessing internal resources not otherwise exposed. Furthermore, when the InMemory database backend is used, the attacker can retrieve the response body from these internal services, resulting in information disclosure. The vulnerability does not impact integrity or availability but has a confidentiality impact limited to information disclosure.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18369 for current remediation guidance. No official fix or workaround is stated in the provided data. Until a patch is available, restrict access to the ACME responder and monitor for suspicious activity related to ACME challenges if feasible.