CVE-2026-18047: Dogtag PKI ACME Auth Bypass Vulnerability

CVE-2026-18047 Overview

CVE-2026-18047 is an authentication bypass vulnerability in the Dogtag PKI Automatic Certificate Management Environment (ACME) responder. The flaw resides in the web.xml security constraints, which use exact URL pattern matching for admin-only enable and disable endpoints. An unauthenticated attacker can append a trailing slash to the target URL to bypass the Tomcat authentication constraint. RESTEasy still routes the modified request to the underlying handler, allowing unauthorized toggling of the ACME service state. The weakness is tracked under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Critical Impact
An unauthenticated network attacker can disable the ACME service, causing persistent denial of service for certificate issuance operations.

Affected Products

Dogtag PKI ACME responder
Red Hat Certificate System (deployments using the ACME responder)
Downstream distributions bundling vulnerable Dogtag PKI packages

Discovery Timeline

2026-07-28 - CVE-2026-18047 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-18047

Vulnerability Analysis

The Dogtag PKI ACME responder exposes administrative endpoints for enabling and disabling the service. Access to these endpoints is restricted through Java servlet security constraints declared in web.xml. The constraints use exact URL pattern matching rather than normalized path matching. This mismatch between Tomcat's constraint evaluation and RESTEasy's request routing creates an exploitable gap.

When an attacker sends a request such as /acme/enable/ with a trailing slash, Tomcat's authentication constraint does not match the pattern and skips authentication. RESTEasy, however, normalizes the path and dispatches the request to the same handler that would service /acme/enable. The result is unauthenticated invocation of an administrator-only operation.

Root Cause

The root cause is inconsistent URL normalization between two components in the same request pipeline. The web.xml security constraint framework treats the trailing slash as a distinct resource path. RESTEasy resolves both forms to the same JAX-RS resource method. The security policy therefore fails open for the alternate path.

Attack Vector

Exploitation requires only network reachability to the ACME responder endpoint. The attacker crafts an HTTP request to the administrative enable or disable URL with a trailing slash appended. No credentials, tokens, or user interaction are required. Repeated invocation of the disable endpoint produces persistent denial of service for ACME certificate issuance.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-18047 Advisory and Red Hat Bug Report #2507956 for authoritative technical details.

Detection Methods for CVE-2026-18047

Indicators of Compromise

HTTP requests to ACME administrative paths such as /acme/enable/ or /acme/disable/ with a trailing slash from unauthenticated sources
Unexpected transitions of the ACME service state in Dogtag PKI audit logs without a corresponding administrator session
Failures of ACME client enrollments correlating with service-state changes

Detection Strategies

Inspect Tomcat access logs for requests to ACME admin endpoints that return 200 or 204 status codes without an associated authenticated session identifier
Correlate ACME service enable and disable events in pki-tomcat audit logs against the authenticated administrator user list
Deploy a web application firewall rule that blocks or alerts on requests to administrative ACME paths ending in /

Monitoring Recommendations

Enable verbose audit logging on the Dogtag PKI ACME subsystem and forward events to a centralized log platform
Alert on any state change of the ACME responder outside approved change windows
Track certificate issuance failure rates as a proxy indicator for unauthorized service disablement

How to Mitigate CVE-2026-18047

Immediate Actions Required

Restrict network access to Dogtag PKI ACME administrative endpoints using firewall or reverse-proxy allowlists
Block HTTP requests to /acme/enable/ and /acme/disable/ variants with trailing slashes at the perimeter until patches are applied
Review recent audit logs for signs of unauthorized ACME service-state toggling

Patch Information

Refer to the Red Hat CVE-2026-18047 Advisory for fixed package versions and errata applicable to affected Red Hat products. Apply vendor-supplied Dogtag PKI updates that correct the web.xml security constraint patterns to cover normalized URL forms.

Workarounds

Place a reverse proxy in front of the ACME responder that normalizes trailing slashes before authentication is evaluated
Add explicit web.xml security constraint entries covering both /acme/enable and /acme/enable/ patterns, and the equivalent disable paths
Restrict administrative endpoints to management network segments only, denying all external access

bash

# Example nginx reverse-proxy rule to block unauthenticated trailing-slash bypass
location ~ ^/acme/(enable|disable)/?$ {
    allow 10.0.0.0/24;   # management subnet
    deny  all;
    proxy_pass http://pki-tomcat-backend;
}