CVE-2026-18369 Overview
CVE-2026-18369 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Dogtag PKI's Automatic Certificate Management Environment (ACME) responder. The HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without verifying that the target resolves to a public address. An unauthenticated ACME account holder can abuse this behavior to coerce the Dogtag server into issuing HTTP GET requests against internal network services. When the ACME responder is configured with the InMemory database backend, response bodies from internal targets are reflected back to the attacker through ACME challenge error messages.
Critical Impact
Unauthenticated attackers can pivot through the Dogtag PKI server to reach internal-only services and exfiltrate response contents via ACME error messages.
Affected Products
- Dogtag PKI ACME responder
- Red Hat Certificate System (Dogtag-based distributions)
- Deployments using the ACME InMemory database backend
Discovery Timeline
- 2026-07-30 - CVE-2026-18369 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18369
Vulnerability Analysis
The Dogtag PKI ACME responder implements the HTTP-01 challenge defined by RFC 8555 to prove control of a domain. During validation, the server issues an HTTP GET request to http://<identifier>/.well-known/acme-challenge/<token> and compares the response against the expected key authorization. The validator fails to enforce that the dns identifier is a valid hostname and does not restrict the network location of the request target. Attackers can register identifiers containing raw IPv4 or IPv6 literals, including private, loopback, and link-local ranges, and cause the responder to issue outbound requests to arbitrary internal endpoints.
The flaw is compounded by the responder's redirect handling. When the initial challenge target returns an HTTP 3xx response, the validator follows the redirect without re-validating the resulting URL. An attacker who controls only a public host can chain a redirect to internal metadata services, administrative interfaces, or unauthenticated internal APIs.
Root Cause
The root cause is missing input validation and destination filtering in the HTTP-01 challenge validator. The code path accepts IP literals in the dns identifier field and delegates fetching to an HTTP client configured to transparently follow redirects. No allowlist, DNS rebinding protection, or private-address filter is applied before or after redirects.
Attack Vector
An attacker registers an ACME account with the Dogtag server and submits a new order specifying a target identifier. The identifier can be an internal IP literal directly, or a public hostname under attacker control that redirects to an internal resource. The Dogtag server issues the challenge request and, when using the InMemory database backend, records the response body in the challenge error object. The attacker retrieves the error via the standard ACME challenge polling flow and reads the disclosed content. See the Red Hat CVE-2026-18369 Advisory and Red Hat Bug Report #2509234 for vendor-supplied technical details.
Detection Methods for CVE-2026-18369
Indicators of Compromise
- ACME newOrder requests containing identifier values with raw IPv4 or IPv6 literals, including RFC 1918, loopback (127.0.0.0/8), or link-local (169.254.0.0/16) ranges.
- Outbound HTTP requests from the Dogtag PKI host to internal address space on /.well-known/acme-challenge/ paths.
- ACME challenge error records in the InMemory backend containing response fragments from internal services such as cloud metadata endpoints or admin consoles.
Detection Strategies
- Inspect ACME server logs for newOrder and newAuthz requests whose identifier field parses as an IP address rather than a hostname.
- Correlate Dogtag process network telemetry with internal destination IPs on port 80 to surface unexpected challenge validation traffic.
- Alert on ACME challenge error responses whose size or content substantially exceeds the expected key-authorization payload length.
Monitoring Recommendations
- Forward Dogtag ACME access logs and host network flows to a centralized analytics platform for retrospective SSRF hunting.
- Track newly created ACME accounts followed within a short window by order requests targeting non-public identifiers.
- Monitor for HTTP 3xx responses returned to the Dogtag server from external hosts, which may indicate redirect-based SSRF chaining.
How to Mitigate CVE-2026-18369
Immediate Actions Required
- Apply the Dogtag PKI patch referenced in the Red Hat CVE-2026-18369 Advisory once available for your distribution.
- Disable the ACME responder if it is not required, or restrict it to trusted network segments through firewall rules.
- Replace the InMemory database backend with a persistent backend that does not surface upstream response bodies in challenge error output.
Patch Information
Refer to the Red Hat CVE-2026-18369 Advisory and Red Hat Bug Report #2509234 for fixed package versions and errata specific to affected Red Hat Certificate System and Dogtag PKI releases. No fixed version is enumerated in the current NVD record.
Workarounds
- Configure network egress policy on the Dogtag PKI host to deny outbound HTTP traffic to RFC 1918, loopback, link-local, and cloud metadata address ranges.
- Front the ACME responder with a reverse proxy that rejects newOrder requests whose identifier field parses as an IP literal.
- Require ACME External Account Binding (EAB) so that only pre-authorized accounts can submit orders while a patched build is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
