CVE-2026-17039: PKI-Core Auth Bypass Vulnerability

CVE-2026-17039 Overview

CVE-2026-17039 is an authorization flaw in pki-core, the certificate authority component used in Dogtag PKI and Red Hat Certificate System. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. An authenticated user entitled to one realm can cause a certificate belonging to a different realm to be renewed without that realm's authorization. The flaw is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can trigger renewal of certificates in realms they should not control, bypassing multi-tenant boundaries and impacting certificate integrity.

Affected Products

Dogtag PKI (pki-core) — CA renewal path in RenewalProcessor.java
Red Hat Certificate System components relying on pki-core
Deployments using realm-based authorization for certificate operations

Discovery Timeline

2026-07-24 - CVE-2026-17039 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-17039

Vulnerability Analysis

The vulnerability stems from an authorization gap between two parallel request paths in pki-core. The enrollment path invokes authz.checkRealm() to confirm that the authenticated user is entitled to operate on the realm associated with the request. The renewal path performs no equivalent check. An authenticated user assigned to Realm A can therefore submit a renewal request referencing a certificate that belongs to Realm B, and the CA will process it without validating cross-realm authorization.

The defect is a business logic flaw rather than a memory-safety issue. Exploitation requires network access, valid low-privilege credentials, and knowledge of a target certificate's identifiers. It does not require user interaction. The attack surface is limited to environments that rely on realms to segregate tenants or administrative scopes.

Root Cause

The root cause is missing enforcement of realm authorization in the renewal servlet. The fix for the earlier enrollment gap (see CVE-2021-20179) added realm validation in EnrollmentProcessor.java, but the equivalent logic was never mirrored in RenewalProcessor.java or in the associated CertServlet endpoints. Any request handler that resolves a certificate by serial number without checking the certificate's realm against the caller's realm entitlement inherits this flaw.

Attack Vector

An attacker authenticates to the CA with credentials tied to one realm and submits a renewal request for a certificate that belongs to a different realm. Because the renewal path does not call authz.checkRealm(), the CA issues a renewed certificate. The following patch excerpt shows the authorization pattern that the enrollment path implements and that the renewal path was missing:

java

ctx, authenticator, authToken, reqs);
endTiming("request_population");

///////////////////////////////////////////////
// validate realm (if present)
///////////////////////////////////////////////
for (IRequest req : reqs) {
    String realm = req.getRealm();
    if (StringUtils.isNotBlank(realm)) {
        authz.checkRealm(realm, authToken, null,
                "certServer.ca.request.enrollment", "submit");
    }
}

///////////////////////////////////////////////
// submit request
///////////////////////////////////////////////

Source: Dogtag PKI commit e2de267. The fix for CVE-2026-17039 applies the same checkRealm pattern to the renewal request pipeline.

Detection Methods for CVE-2026-17039

Indicators of Compromise

Renewal requests in CA transaction logs where the authenticated user's realm does not match the target certificate's realm.
Unexpected renewed certificates issued for realms with no recent operator activity.
Repeated renewal submissions from a single authenticated identity referencing certificate serials across multiple realms.

Detection Strategies

Correlate CA audit log entries (AUTHZ_FAIL, CERT_REQUEST_PROCESSED, CERT_STATUS_CHANGE) against the requesting user's realm entitlement in the directory backend.
Baseline normal renewal volume per realm and alert on renewals initiated by identities outside that realm.
Review requests hitting RenewalProcessor and CertServlet renewal endpoints for realm mismatches prior to the patch being applied.

Monitoring Recommendations

Forward pki-ca audit logs and Tomcat access logs to a central log store for retention and cross-realm correlation.
Alert on any renewal operation where the request realm attribute differs from the authenticated principal's realm membership.
Track patch state of pki-core packages across all CA subsystems and flag hosts still exposing the unpatched renewal path.

How to Mitigate CVE-2026-17039

Immediate Actions Required

Apply the vendor-supplied pki-core update once available from your distribution; consult the Red Hat advisory for CVE-2026-17039 for package versions.
Restrict network access to the CA renewal endpoints so only trusted subsystems and administrators can reach them.
Audit issued certificates for unexpected renewals that occurred prior to patching and revoke any that cannot be attributed to an authorized realm operator.

Patch Information

The upstream fix mirrors the enrollment-path realm check into the renewal path by invoking authz.checkRealm() on each request before submission. Reference the Dogtag PKI renewal processor source and the historical commit e2de267 for the authorization pattern applied by the vendor. Coordinate deployment with the Red Hat Bugzilla report #2506720 tracking guidance.

Workarounds

Tighten the CA ACL configuration in acl.ldif to restrict certServer.ca.certrequest renewal operations to a minimal set of trusted principals until the patch is applied.
Disable or firewall the renewal REST endpoints for external consumers while retaining enrollment paths that already enforce realm checks.
Rotate CA operator credentials scoped to individual realms and reduce shared accounts that could reach across realms.

bash

# Configuration example: restrict renewal endpoint via reverse proxy allowlist
# Only allow trusted management subnets to reach the CA renewal path
<Location "/ca/rest/certrequests">
    Require ip 10.0.10.0/24
    Require ip 10.0.20.0/24
</Location>
<Location "/ca/agent/ca/profileProcess">
    Require ip 10.0.10.0/24
</Location>