Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T10:02:44 dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CWE-918

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

Red Hat rates this Moderate because exploitation is limited to HTTP GET requests (no integrity impact), the attacker cannot read internal responses on production-supported backends (low confidentiality impact), and the ACME responder must be explicitly deployed. The Scope is Changed (S:C) because the ACME responder causes the Dogtag server to make outbound requests to services outside its own trust boundary, but the actual information gained on supported configurations is limited to network topology probing. While the SSRF is GET-only and does not directly allow data modification, administrators should be aware that internal services reachable from the Dogtag host which perform actions on HTTP GET (such as cloud instance metadata endpoints that issue temporary credentials) could be indirectly affected. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Certificate System 10 Fix deferred redhat-pki:10/redhat-pki Red Hat Certificate System 11 Fix deferred redhat-pki Red Hat Certificate System 9 Fix deferred pki-core Red Hat Certificate System 9 Fix deferred redhat-pki Red Hat Enterprise Linux 10 Fix deferred dogtag-pki Red Hat Enterprise Linux 6 Fix deferred pki-core Red Hat Enterprise Linux 7 Fix deferred pki-core Red Hat Enterprise Linux 8 Fix deferred pki-core:10.6/pki-core Red Hat Enterprise Linux 9 Fix deferred pki-core https://www.cve.org/CVERecord?id=CVE-2026-18369 https://nvd.nist.gov/vuln/detail/CVE-2026-18369