VDB

RHSA-2026:86624

RHSA-2026:86624 PUBLISHED CVSS 7.199999809265137 HIGH

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Risk Scores

CVSS 3.1
7.199999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatpki-core-debugsource-0:11.5.0-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-debuginfo-0:11.5.0-3.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-0:11.5.0-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-debuginfo-0:11.5.0-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatpki-core-debugsource-0:11.5.0-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-base-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-0:11.5.0-3.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-debuginfo-0:11.5.0-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-acme-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-debuginfo-0:11.5.0-3.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatpki-core-debugsource-0:11.5.0-3.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-server-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-kra-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-ca-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatpki-core-0:11.5.0-3.el9_4.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-java-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatpython3-idm-pki-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-est-0:11.5.0-3.el9_4.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatidm-pki-tools-0:11.5.0-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4
Red Hatpki-core-debugsource-0:11.5.0-3.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)0:11.5.0-3.el9_4

…and 1 more

Timeline

  • Oct 21, 2026 CVE Published
  • Nov 2, 2026 CVE Updated
  • Nov 2, 2026 Distribution Patch
  • Nov 2, 2026 Distribution Patch
  • Nov 2, 2026 Security Advisory
  • Nov 2, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›