---
id: CVE-2026-18047
title: >-
  Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint
  authentication bypass via trailing slash
summary: >-
  A flaw was found in Dogtag PKI's ACME responder where the web.xml security
  constraints use exact URL pattern matching for admin-only enable/disable
  endpoints. By appending a trailing slash to the URL, an unauthenticated
  attacker can bypa…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-288
vendor: Red Hat
product: 'redhat-pki:10/redhat-pki'
affected:
  - 'redhat-pki:10/redhat-pki (all versions)'
  - redhat-pki (all versions)
  - pki-core
  - redhat-pki
  - dogtag-pki (all versions)
  - pki-core
  - pki-core (all versions)
  - 'pki-core:10.6/pki-core (all versions)'
  - pki-core (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-28T13:26:20.679235Z'
published: '2026-07-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:25:04.849Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-18047'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18047'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507956'
    label: RHBZ#2507956
tags:
  - cve.org
epss: 0.00492
epssPercentile: 0.42404
ingestedAt: '2026-11-05T22:38:31.537Z'
---

## Overview

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.

## Affected

- `redhat-pki:10/redhat-pki (all versions)`
- `redhat-pki (all versions)`
- `pki-core`
- `redhat-pki`
- `dogtag-pki (all versions)`
- `pki-core`
- `pki-core (all versions)`
- `pki-core:10.6/pki-core (all versions)`
- `pki-core (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this vulnerability, change the URL patterns in the ACME responder's web.xml from exact-match to prefix-match.
Edit the file /usr/share/pki/acme/webapps/acme/WEB-INF/web.xml and replace the url-pattern entries for the enable and disable endpoints:

<url-pattern>/enable</url-pattern>  ->  <url-pattern>/enable/*</url-pattern>
<url-pattern>/disable</url-pattern> ->  <url-pattern>/disable/*</url-pattern>

Then restart the PKI server for the changes to take effect.