CVE-2026-76561
Description
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.
Statement
Exploitation of this flaw requires an existing CA-Administrator-equivalent account; it is not exploitable by an anonymous or unprivileged user on its own. This precondition is already reflected in the CVSS vector via Privileges Required: High. The integrated Dogtag certificate authority is enabled by default in a standard ipa-server-install deployment, and certificate profile import is a routine, expected CA Administrator operation. Once that precondition is met, exploitation is deterministic and reaches full code execution as pkiuser, with further escalation to root observed in tested environments. On its own, this flaw provides a privilege-escalation path from CA Administrator to host-level code execution
Mitigation
Until a fixed package is available, restrict membership in CA Administrator and equivalent roles to fully trusted operators, and audit certificate profile import operations for unexpected or unrecognized profile content. Review any custom ExternalProcessConstraint executable configuration in Dogtag for unnecessary exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.2 | N/A | 7.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Confirmed via sandbox reproduction: certprofile-import -> ExternalProcessConstraint executed attacker-controlled commands as pkiuser, further escalating to full root in the reference container (verified via an independent-channel file read-back, not just PoC stdout). AV:N/AC:L/UI:N: reachable over the management API, deterministic, no user interaction. PR:H: requires an already-authenticated CA-Administrator-equivalent account -- not reachable anonymously on its own, hence lower than the companion FreeIPA flaw. S:U/C:H/I:H/A:H: pkiuser-level code execution already grants full read/write/disrupt capability over CA operations and key material. Whether the further root escalation applies to genuine RHEL RPM packaging (vs. being specific to the community container's SSSD/ksu setup) is unconfirmed; if confirmed, this may warrant reassessment toward Scope:Changed.
Acknowledgements
Red Hat would like to thank Gia Bui (yabeow) (Calif.io) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
