---
id: CVE-2026-17039
title: >-
  Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing
  omits realm authorization check performed by enrollment path
summary: >-
  A flaw was found in pki-core. The certificate authority (CA) renewal request
  path does not perform the realm-based authorization check that the enrollment
  path performs, allowing an authenticated user entitled to one realm to cause a
  cer…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Red Hat
product: redhat-pki
affected:
  - redhat-pki (all versions)
  - redhat-pki (all versions)
  - pki-core (all versions)
  - dogtag-pki (all versions)
  - pki-core (all versions)
  - pki-core (all versions)
  - pki-core (all versions)
  - pki-core (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-25T00:53:34.296639Z'
published: '2026-07-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:05:36.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-17039'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2021-20179'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-17039'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506720'
    label: RHBZ#2506720
  - url: 'https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldif'
  - url: >-
      https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.java
  - url: >-
      https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.java
  - url: >-
      https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.java
  - url: >-
      https://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6
tags:
  - cve.org
epss: 0.00259
epssPercentile: 0.17679
ingestedAt: '2026-11-06T19:01:36.642Z'
---

## Overview

A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

## Affected

- `redhat-pki (all versions)`
- `redhat-pki (all versions)`
- `pki-core (all versions)`
- `dogtag-pki (all versions)`
- `pki-core (all versions)`
- `pki-core (all versions)`
- `pki-core (all versions)`
- `pki-core (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Deployments that do not configure a realm-mapped authorization manager (AuthzRealmDefault with a non-default realm-to-authorization-manager mapping) for multi-tenant or delegated sub-CA use are not exposed to this issue. For deployments that do use realm-based authorization, using a renewal profile that additionally restricts renewal requests to the original requester narrows exposure: the shipped caDirUserRenewal.cfg profile configures authz.acl=user_origreq="auth_token.uid", which independently blocks cross-user renewal by comparing the renewing caller's UID against the UID that submitted the original request. This is a partial mitigation only -- it is realm-blind rather than realm-aware, so a UID collision across two independently-administered realms' user directories would still bypass it -- and it does not apply to caManualRenewal.cfg or other shipped renewal profiles that configure no authz.acl, which remain exploitable as described. No complete mitigation is available; apply the update once released.