CVE-2026-53682

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.

Rated Moderate because this is unauthenticated disclosure of internal host and topology metadata only; the disclosed hostnames and roles do not directly expose credentials or sensitive data, making this a reconnaissance/follow-on-attack enabler rather than a direct compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Remove unnecessary version and topology details from the unauthenticated response.