{"id":"CVE-2026-104988","published":"2026-10-02T20:17:01.370","lastModified":"2026-10-06T15:09:20.387","description":"A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104988","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545316","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The CMCAuthForEST authentication plugin in Dogtag PKI fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate, allowing an authenticated user to obtain CA-signed certificates with arbitrary subject names.","exploitability":"Exploitation requires an authenticated user with BasicAuth access to the EST service, making it moderately exploitable.","blast_radius":"If exploited, this flaw could allow an attacker to issue certificates with any subject name, potentially leading to unauthorized certificate issuance and misuse.","remediation":"Disable the CMCAuthForEST authentication plugin or restrict access to the EST service to require end-user TLS client certificates.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","certificate","pki"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:29.731Z"}}