CVE-2026-80110: Incorrect Authorization in Red Hat Red Hat Certificate System 9
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
AI Analysis
Technical Summary
The vulnerability in Red Hat Certificate System 9's pki-core involves the v2 REST ACL filter's incorrect tie-breaking logic for colliding ACL keys. Instead of selecting the most specific permission, it uses lexicographic string comparison, allowing a wildcard ACL permission to override a more specific literal ACL permission. This flaw permits users with the profiles.approve permission, typically assigned to the default Certificate Manager Agents group, to perform actions requiring the higher privileged profiles.create permission via the POST /v2/profiles/raw API endpoint. This misauthorization can compromise the confidentiality and integrity of the certificate authority's issuance policy.
Potential Impact
An attacker or user with the lower-privileged profiles.approve permission can perform actions reserved for Administrator-level profiles.create permission, specifically posting raw profiles in the CA's profile-management API. This unauthorized elevation of privilege threatens the confidentiality and integrity of the certificate authority's issuance policy, potentially allowing unauthorized certificate issuance or modification.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-80110 for current remediation guidance. Until an official fix is available, restrict access to the profiles.approve permission and monitor for unauthorized use of the POST /v2/profiles/raw endpoint.
CVE-2026-80110: Incorrect Authorization in Red Hat Red Hat Certificate System 9
Description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
CVSS v3.1
Score 8.1high
Affected software
Red Hat
Red Hat Certificate System 9
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 6
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Red Hat Certificate System 9's pki-core involves the v2 REST ACL filter's incorrect tie-breaking logic for colliding ACL keys. Instead of selecting the most specific permission, it uses lexicographic string comparison, allowing a wildcard ACL permission to override a more specific literal ACL permission. This flaw permits users with the profiles.approve permission, typically assigned to the default Certificate Manager Agents group, to perform actions requiring the higher privileged profiles.create permission via the POST /v2/profiles/raw API endpoint. This misauthorization can compromise the confidentiality and integrity of the certificate authority's issuance policy.
Potential Impact
An attacker or user with the lower-privileged profiles.approve permission can perform actions reserved for Administrator-level profiles.create permission, specifically posting raw profiles in the CA's profile-management API. This unauthorized elevation of privilege threatens the confidentiality and integrity of the certificate authority's issuance policy, potentially allowing unauthorized certificate issuance or modification.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-80110 for current remediation guidance. Until an official fix is available, restrict access to the profiles.approve permission and monitor for unauthorized use of the POST /v2/profiles/raw endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-25T19:49:07.193Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-80110","vendor":"Red Hat"}]
Threat ID: 6ab13ff155bf5e2cf5064d2a
Added to database: 09/21/2026, 14:32:17 UTC
Last enriched: 09/21/2026, 14:46:39 UTC
Last updated: 09/22/2026, 00:35:05 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.