« Volver al listado

CVE-2026-17039

Estado: Pendiente de análisisBaja (3.1)—

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

PKI — Pki-coreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-17039",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-17039",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-25T00:53:34.296639Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:certificate_system:10"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Certificate System 10",
          "packageName": "redhat-pki",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:certificate_system:11"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Certificate System 11",
          "packageName": "redhat-pki",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:certificate_system:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Certificate System 9",
          "packageName": "pki-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "packageName": "dogtag-pki",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "pki-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "pki-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "pki-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "packageName": "pki-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-24T16:16:34.367",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2021-20179",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-17039",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506720",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.java",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization."
    }
  ],
  "lastModified": "2026-07-25T02:16:39.073",
  "sourceIdentifier": "secalert@redhat.com"
}