A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-104988",
  "cvss": {
    "score": 8.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 8.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-290",
      "name": "Authentication Bypass by Spoofing"
    }
  ],
  "description": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.",
  "ghsa_id": "GHSA-qgmm-v3v3-wff2",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qgmm-v3v3-wff2"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104988"
    }
  ],
  "nvd_published_at": "2026-10-02T20:17:01Z",
  "published_at": "2026-10-02T21:32:06Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104988",
    "https://access.redhat.com/security/cve/CVE-2026-104988",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2545316",
    "https://github.com/advisories/GHSA-qgmm-v3v3-wff2"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...",
  "type": "unreviewed",
  "updated_at": "2026-10-02T21:32:18Z",
  "url": "https://api.github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "vulnerabilities": [],
  "withdrawn_at": null
}

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-104988",
  "cvss": {
    "score": 8.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 8.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-290",
      "name": "Authentication Bypass by Spoofing"
    }
  ],
  "description": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.",
  "ghsa_id": "GHSA-qgmm-v3v3-wff2",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qgmm-v3v3-wff2"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104988"
    }
  ],
  "nvd_published_at": "2026-10-02T20:17:01Z",
  "published_at": "2026-10-02T21:32:06Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104988",
    "https://access.redhat.com/security/cve/CVE-2026-104988",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2545316",
    "https://github.com/advisories/GHSA-qgmm-v3v3-wff2"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...",
  "type": "unreviewed",
  "updated_at": "2026-10-02T21:32:18Z",
  "url": "https://api.github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "vulnerabilities": [],
  "withdrawn_at": null
}

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-104988",
  "cvss": {
    "score": 8.1,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 8.1,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-290",
      "name": "Authentication Bypass by Spoofing"
    }
  ],
  "description": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.",
  "ghsa_id": "GHSA-qgmm-v3v3-wff2",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qgmm-v3v3-wff2"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-104988"
    }
  ],
  "nvd_published_at": "2026-10-02T20:17:01Z",
  "published_at": "2026-10-02T21:32:06Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-104988",
    "https://access.redhat.com/security/cve/CVE-2026-104988",
    "https://bugzilla.redhat.com/show_bug.cgi?id=2545316",
    "https://github.com/advisories/GHSA-qgmm-v3v3-wff2"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open...",
  "type": "unreviewed",
  "updated_at": "2026-10-02T21:32:18Z",
  "url": "https://api.github.com/advisories/GHSA-qgmm-v3v3-wff2",
  "vulnerabilities": [],
  "withdrawn_at": null
}