Flaw in PKI Core Affects Certificate Authority's Profile Management API
CVE-2026-80110
8.1HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 21 September 2026
What is CVE-2026-80110?
A vulnerability exists in the PKI Core where the v2 REST ACL filter improperly prioritizes permissions during conflicts between literal and wildcard ACL keys. This design flaw permits a wildcard permission to override a more specific literal permission. As a result, actions that should require administrator-level permissions can be authorized under lower-privileged roles, posing significant risks to the confidentiality and integrity of the certificate authority's issuance policy.
Affected Version(s)
Red Hat Enterprise Linux 10 0:11.9.0-5.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-3.el10_0.1
Red Hat Enterprise Linux 9 0:11.7.1-2.el9_8
References
CVSS V3.1
Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Arpit Jain ((GitHub handle: arpitjain099)) for reporting this issue.