CVE-2026-53682: PKI Security Domain Information Disclosure

CVE-2026-53682 Overview

CVE-2026-53682 is an information disclosure vulnerability in a Public Key Infrastructure (PKI) Certificate Authority (CA) REST endpoint. An unauthenticated client can issue a GET /ca/rest/securityDomain/hosts request and receive a structured response enumerating the Security Domain hosts inventory. The response reveals internal PKI/CA hosts, roles, security domain topology, and participating subsystems. No principal, client certificate, or session is required to retrieve the data. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate internal PKI/CA topology, providing reconnaissance data useful for targeting subsystems that issue and manage certificates.

Affected Products

PKI/CA subsystem exposing the /ca/rest/securityDomain/hosts REST endpoint
Red Hat referenced products (see Red Hat CVE-2026-53682 Advisory)
Deployments where the CA REST interface is reachable from untrusted networks

Discovery Timeline

2026-09-01 - CVE-2026-53682 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-53682

Vulnerability Analysis

The vulnerability resides in the CA subsystem's REST interface handling of the securityDomain/hosts resource. The endpoint accepts an HTTP GET request and returns a structured document describing every host that participates in the security domain. That document typically includes hostnames, port numbers, subsystem roles such as CA, KRA, OCSP, TKS, and TPS, and clone or master designations.

Proper access control requires callers to present a valid principal, client TLS certificate, or authenticated session. In vulnerable builds, the endpoint bypasses this control and responds to anonymous requests. The information returned constitutes reconnaissance data that supports follow-on attacks against enrollment, key recovery, and status responder services.

Root Cause

The root cause is a missing or misconfigured authorization check on the REST handler serving GET /ca/rest/securityDomain/hosts. The route is not gated by the authentication filter that protects other administrative endpoints, so the servlet returns the inventory to any network peer that can reach the CA port.

Attack Vector

Exploitation requires only network reachability to the CA REST interface. An attacker issues a single unauthenticated HTTP GET request against the vulnerable path and parses the returned host list. The enumerated data can be used to fingerprint the deployment, identify clone relationships, and select specific subsystems for targeted follow-on activity.

No verified public exploit code is available. See the Red Hat Bug Report #2487511 for vendor technical details.

Detection Methods for CVE-2026-53682

Indicators of Compromise

Unauthenticated HTTP GET requests to /ca/rest/securityDomain/hosts in CA access logs
Requests to the endpoint originating from external or non-administrative source IP ranges
Anonymous responses returning 200 OK with a non-empty host inventory payload

Detection Strategies

Parse CA subsystem access logs for the securityDomain/hosts URI and flag requests without an associated authenticated principal
Correlate reconnaissance requests to the endpoint with subsequent probes against CA, KRA, OCSP, TKS, or TPS ports
Deploy a web application firewall rule that alerts on any request to the endpoint that lacks a client certificate

Monitoring Recommendations

Forward CA subsystem access and audit logs to a centralized SIEM for retention and correlation
Baseline expected callers of the securityDomain REST resources and alert on deviations
Monitor for scan patterns that enumerate PKI infrastructure across multiple hosts in short time windows

How to Mitigate CVE-2026-53682

Immediate Actions Required

Restrict network access to the CA REST interface so that only administrative networks and peer PKI subsystems can reach it
Review CA access logs for prior unauthenticated requests to /ca/rest/securityDomain/hosts and record source addresses
Apply vendor updates referenced in the Red Hat CVE-2026-53682 Advisory as they become available

Patch Information

Refer to the Red Hat CVE-2026-53682 Advisory and Red Hat Bug Report #2487511 for fixed package versions and errata. Apply the vendor-supplied update that enforces authentication on the securityDomain/hosts REST handler.

Workarounds

Block external access to the CA REST endpoint using a reverse proxy or firewall rule that denies requests to /ca/rest/securityDomain/hosts
Require client certificate authentication at the reverse proxy tier for all /ca/rest/ paths
Segment PKI subsystems onto a management VLAN that is not routable from user networks

bash

# Example reverse proxy rule to block unauthenticated access
# Apache httpd example
<Location "/ca/rest/securityDomain/hosts">
    SSLVerifyClient require
    SSLVerifyDepth  2
    Require valid-user
</Location>