5.8

CVE-2026-18369: Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

Awaiting analysis
AliasesRHSA-2026:67110UBUNTU-CVE-2026-18369DEBIAN-CVE-2026-18369
Published 30-07-2026Last modified 14-09-2026

Vulnerability summary

CVE-2026-18369 is a medium (CVSS 5.8) Server-Side Request Forgery vulnerability in dogtag-pki. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.8/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.38%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 30-07-2026
    PublishedVulnerability first disclosed.
  2. 14-09-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

Increase +0.16 pp

From 0.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat31 products
  • idm-console-framework< 0:1.3.0-1.module+el8pki+14677+1ef79a68
  • jss< 0:4.9.11-1.module+el8pki+24697+be195eea
  • jss-debuginfo< 0:4.9.11-1.module+el8pki+24697+be195eea
  • jss-debugsource< 0:4.9.11-1.module+el8pki+24697+be195eea
  • jss-javadoc< 0:4.9.11-1.module+el8pki+24697+be195eea
Debian1 product
  • dogtag-pkiAll versions (No fix recorded)
Ubuntu1 product
  • dogtag-pkiAll versions (No fix recorded)

3 vendors · 33 products

References

10 links