CVE-2026-18047

Medium [CVE-2026-18047] ACME admin enable/disable endpoint authentication bypass via trailing slash

CVE-2026-18047Source published Jul 28, 2026Source updated Jul 28, 2026

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service. Red Hat rates this as Moderate because the impact of the authentication bypass is limited in scope and consequence. The vulnerability only affects the ACME enable/disable admin endpoints — other PKI subsystems (CA, KRA, OCSP, TPS) enforce authorization at the application layer and are not affected by this flaw. An attacker who exploits this flaw can only toggle the…

Affected products in this advisory

• Red Hat Certificate System 10
• Red Hat Certificate System 11
• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10

6 more entries in the full advisory.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• To mitigate this vulnerability, change the URL patterns in the ACME responder's web.xml from exact-match to prefix-match. Edit the file /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml and replace the url-pattern entries for the enable and disable endpoints: <url-pattern>/enable</url-pattern> -> <url-pattern>/enable/*</url-pattern> <url-pattern>/disable</url-pattern> -> <url-pattern>/disable/*</url-pattern> Then restart the PKI server for the changes to take effect.