This vulnerability exists in Dogtag PKI's certificate profile import functionality, which does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit the ExternalProcessConstraint mechanism to execute arbitrary OS commands with attacker-controlled environment variables, resulting in code execution as the pkiuser account. Testing demonstrated deterministic exploitation and further privilege escalation to root in containerized environments. The flaw provides a privilege escalation path from CA Administrator to host-level code execution. Exploitation requires existing CA Administrator privileges and no user interaction. The vulnerability is tracked as CVE-2026-76561 with a CVSS 3.1 score of 7.2 (High).

Successful exploitation allows an attacker with CA Administrator privileges to execute arbitrary commands on the host as the pkiuser account, which controls certificate authority operations and key material. This can lead to full compromise of the certificate authority, including reading, modifying, or disrupting CA operations and key material. Further privilege escalation to root has been observed in tested container environments, potentially allowing complete host compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

No official patch or fix is currently confirmed for this vulnerability. Until a fixed package is available, Red Hat recommends restricting membership in CA Administrator and equivalent roles to fully trusted operators only. Additionally, audit certificate profile import operations for unexpected or unrecognized profile content. Review any custom ExternalProcessConstraint executable configurations in Dogtag PKI to minimize unnecessary exposure. Monitor Red Hat's advisory page for updates on patch availability.