CVE-2026-80110: PKI-Core Authentication Bypass Vulnerability

CVE-2026-80110 Overview

CVE-2026-80110 is a broken access control flaw in pki-core, the certificate system underlying Red Hat Certificate System and Dogtag PKI. The v2 REST access control list (ACL) filter breaks ties between colliding literal and wildcard ACL keys using lexicographic string comparison instead of specificity. As a result, a wildcard-mapped permission can override a more specific literal-mapped permission when both match a request. In the Certificate Authority (CA) profile-management REST API, a request to POST /v2/profiles/raw — intended to require the Administrator-level profiles.create permission — is authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group.

Critical Impact
Members of the Certificate Manager Agents group can create arbitrary certificate profiles in the CA, subverting the issuance policy and enabling issuance of unauthorized certificates.

Affected Products

Red Hat pki-core (Dogtag PKI Certificate System)
Red Hat Certificate System Certificate Authority (CA) subsystem
Deployments exposing the v2 REST profile-management API

Discovery Timeline

2026-09-21 - CVE-2026-80110 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-80110

Vulnerability Analysis

The flaw is an authorization bypass classified under [CWE-863: Incorrect Authorization]. The v2 REST layer in pki-core maintains ACL entries keyed by resource paths. When more than one entry matches an incoming request — for example, a literal path key and a wildcard pattern key — the filter selects a single permission to enforce. The selection algorithm compares the ACL keys as strings using lexicographic ordering rather than evaluating URI specificity. Because a wildcard string can sort ahead of the corresponding literal string, the filter can pick the wildcard entry and enforce the wrong permission.

In the CA profile-management API, this misordering causes POST /v2/profiles/raw to be evaluated against the profiles.approve permission instead of profiles.create. The profiles.approve permission is assigned by default to the Certificate Manager Agents group, while profiles.create is reserved for Administrators. Any agent-level account can therefore submit raw profile definitions and modify the CA's issuance policy.

Root Cause

The root cause is a tie-breaking rule in the v2 REST ACL filter that uses lexicographic string comparison rather than specificity ranking. Specificity-aware routing should always prefer a literal match over a wildcard match. The current logic treats both matches as equivalent candidates and selects one based on string ordering, allowing the less privileged permission to win.

Attack Vector

Exploitation requires network access to the CA REST endpoint and authenticated credentials belonging to the default Certificate Manager Agents group. No user interaction is required. An authenticated agent can craft a POST /v2/profiles/raw request with a malicious profile definition. The ACL filter authorizes the request under profiles.approve, and the CA accepts the new or modified profile. The attacker can then influence which certificates are issued, to whom, and under what constraints, undermining the integrity of the certificate authority.

No public proof-of-concept has been published. The vulnerability is described in the Red Hat Security Advisory CVE-2026-80110 and tracked in Red Hat Bug Report #2523749.

Detection Methods for CVE-2026-80110

Indicators of Compromise

Requests to POST /v2/profiles/raw originating from accounts that are not members of the Administrators group.
New, modified, or unexpected certificate profile definitions in the CA profile store.
Certificates issued with attributes, extensions, or subject fields that violate the documented issuance policy.
Audit log entries showing profile mutations authorized under profiles.approve instead of profiles.create.

Detection Strategies

Enable and review the CA signed audit log, focusing on PROFILE_CERT_APPROVAL and profile configuration change events correlated with the requesting principal.
Parse the pki-core REST access logs for the /v2/profiles/raw path and alert on any non-administrator principal.
Baseline the set of active profiles and alert on any diff outside a controlled change window.

Monitoring Recommendations

Forward pki-core audit and access logs to a centralized log platform for retention and correlation.
Alert on group membership changes for Certificate Manager Agents and Administrators.
Monitor issued certificates for policy deviations such as unexpected extended key usages, wildcards, or long validity periods.

How to Mitigate CVE-2026-80110

Immediate Actions Required

Apply the pki-core update referenced in the Red Hat Security Advisory CVE-2026-80110 as soon as it is available for your distribution.
Audit membership of the Certificate Manager Agents group and remove accounts that do not require agent privileges.
Review all certificate profiles for unauthorized additions or modifications since the CA was deployed.
Rotate or revoke certificates issued from any profile that cannot be verified as legitimate.

Patch Information

Refer to the Red Hat Security Advisory CVE-2026-80110 for the fixed pki-core package versions and errata for each supported Red Hat Certificate System release. Additional engineering context is available in Red Hat Bug Report #2523749. The fix corrects the ACL tie-breaking logic so that literal path matches take precedence over wildcard matches.

Workarounds

Restrict network access to the CA REST API to trusted management hosts using a firewall or reverse proxy ACL.
Temporarily block or reverse-proxy-deny POST /v2/profiles/raw for non-administrator principals until the patch is applied.
Enforce multi-party review of profile changes by requiring out-of-band approval before any profile modification is accepted in production.

bash

# Example reverse-proxy rule (Apache httpd) to block /v2/profiles/raw
# for all clients except the administrative network
<Location "/ca/v2/profiles/raw">
    Require ip 10.10.20.0/24
</Location>