CVE-2026-104988

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.

This vulnerability is rated as having Important impact because authenticated users can abuse Enrollment over Secure Transport (EST) endpoints to obtain unauthorized, valid certificates for arbitrary identities, bypassing profile constraints and CA authorization controls. Exploitation requires EST services to be configured and accessible with HTTP Basic authentication enabled. Environments that do not expose EST fullcmc enrollment profiles or that enforce mutual TLS (mTLS) client certificates are not susceptible to this mis-issuance flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable basic authentication for all users. This can be done by removing the field "UserPasswords" for the user entries in the EST DS server.