CVE-2026-104988: Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. In this scenario, the SSLCLIENTCERT session attribute retains the EST subsystem's own agent certificate instead of being replaced by the end-user's certificate. The parent CMCAuth.verifySignerInfo() then compares the CMC signer's Subject DN against this agent certificate using DER byte comparison, which passes if the attacker crafts a self-signed certificate with a DER-matching Subject DN. The signer certificate's trust chain is not validated — verifySignerInfo() only verifies the CMC message signature against the bundled signer cert's own public key, which trivially passes since the attacker possesses the corresponding private key. Since CMCAuthForEST overrides authenticateCAUser() to skip CA user database verification, and RAHeaderClientCertSubjectNameConstraint sees the agent certificate in SSLCLIENTCERT and allows any subject name for agents, the CA issues a valid certificate with the attacker's requested arbitrary subject. An authenticated EST user with BasicAuth credentials can exploit this to obtain CA-signed certificates impersonating any entity.
Other sources
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSLCLIENTCERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected path is EST fullcmc enrollment using BasicAuth when the requesting end user does not present a TLS client certificate. An authenticated EST user in that scenario can reach the vulnerable authentication flow.
What does an attacker need to exploit it?
The attacker needs valid EST BasicAuth credentials and must submit a signed CMC request containing a self-signed signer certificate whose Subject DN DER encoding matches the EST subsystem agent certificate's Subject DN. The attacker can sign the request because they control the private key for the bundled self-signed certificate.
Why does the request pass certificate and subject validation?
The signer certificate's trust chain is not validated; the code verifies only that the CMC message was signed by the bundled signer's own public key. The missing end-user TLS certificate causes the session attribute to retain the subsystem agent certificate, and the agent identity permits arbitrary requested subject names.