A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade idm-pki-acmeUpgrade idm-pki-caUpgrade idm-pki-javaUpgrade python3-idm-pkiUpgrade idm-pki-kraUpgrade idm-pki-toolsUpgrade idm-pki-serverUpgrade idm-pki-base | Oct 11, 2026 | Sep 30, 2026 |
| Redhat_linux | — | Upgrade idm-pki-javaUpgrade idm-pki-acmeUpgrade idm-pki-kraUpgrade idm-pki-toolsUpgrade python3-idm-pkiUpgrade idm-pki-baseUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-serverNo solution existsUpgrade idm-pki-caUpgrade pki-core-debugsourceUpgrade dogtag-pki-debugsource | Sep 23, 2026 | Sep 15, 2026 |
| Rocky_linux | — | Upgrade idm-pki-toolsUpgrade dogtag-pki-debugsourceUpgrade pki-core-debugsourceUpgrade idm-pki-tools-debuginfo | Oct 5, 2026 | Oct 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub