CVE-2026-53682: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Red Hat Red Hat Certificate System 9

The vulnerability allows unauthenticated clients to access the Security Domain hosts inventory via a GET request to /ca/rest/securityDomain/hosts, receiving a structured response enumerating internal PKI/CA hosts and roles. This disclosure does not require any principal, client certificate, or session, thus exposing internal system topology information to unauthorized parties. The issue is categorized under CWE-200 (Exposure of Sensitive Information) and CWE-284 (Improper Access Control). Red Hat rates the impact as low confidentiality impact with no integrity or availability impact, making it a reconnaissance enabler rather than a direct exploit vector. The vendor advisory notes the need to remove unnecessary details from unauthenticated responses. There is no indication of an official fix or patch availability at this time.

The vulnerability results in the unauthenticated disclosure of internal hostnames and roles related to the PKI/CA infrastructure, which could facilitate follow-on attacks by providing attackers with detailed internal topology information. However, it does not expose credentials or sensitive data directly, and there is no impact on integrity or availability. This limits the immediate risk but still represents a moderate confidentiality concern.

Red Hat advises removing unnecessary version and topology details from the unauthenticated response to mitigate this vulnerability. There is no vendor advisory indicating that a patch or official fix is currently available. Users should monitor the Red Hat advisory for updates and apply mitigations as recommended. No urgent remediation is indicated as the issue is primarily an information disclosure enabling reconnaissance.