CVE-2026-76561: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Enterprise Linux 10

This vulnerability exists in Dogtag PKI's certificate profile import functionality used by FreeIPA's CA component in Red Hat Enterprise Linux 10. The flaw is due to insufficient validation of uploaded profile content beyond the profile ID, enabling an authenticated CA Administrator to exploit the ExternalProcessConstraint mechanism to execute arbitrary OS commands with attacker-controlled environment variables. This leads to code execution under the pkiuser account. The issue is tracked as CVE-2026-76561 with a CVSS 3.1 score of 7.2 (high severity). Red Hat has released a security update for dogtag-pki packages in RHEL 10 to fix this vulnerability.

An authenticated user with CA Administrator privileges can achieve arbitrary code execution as the pkiuser account by exploiting this vulnerability. This compromises the integrity and availability of the affected system's certificate authority component, potentially allowing unauthorized actions within the PKI infrastructure. The CVSS score of 7.2 reflects high impact on confidentiality, integrity, and availability.

Red Hat has released an official security update for dogtag-pki packages in Red Hat Enterprise Linux 10 that addresses this vulnerability. Users should apply the update as detailed in Red Hat advisory RHSA-2026:73765 and the referenced article https://access.redhat.com/articles/11258. Applying this update fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the official patch.