CVE-2026-18047: Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.
Other sources
A flaw was found in Dogtag PKI's ACME responder. The web.xml security constraints protecting the admin-only /v1/enable and /v1/disable endpoints use exact URL pattern matching (/v1/enable and /v1/disable). Due to a path normalization inconsistency between Tomcat's security constraint matching (which requires exact path match per Servlet spec §12.2) and RESTEasy's JAX-RS path routing (which normalizes trailing slashes), a request to /v1/enable/ bypasses the authentication constraint while still being routed to ACMEEnableService.handlePOST(). Neither ACMEEnableService nor ACMEDisableService performs application-level authorization checks — they directly call database.setEnabled(true/false). An unauthenticated remote attacker can exploit this to enable or disable ACME services, allowing persistent denial of service by repeatedly disabling the service, or re-enabling a service that was intentionally disabled by an administrator.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Tomcat web.xml security-constraint mappings for the admin-only ACME enable/disable endpoints so that authentication cannot be bypassed by a trailing slash. Ensure the constraints apply to requests that would otherwise be routed to ACMEEnableService.handlePOST() / ACMEDisableService.handlePOST() despite RESTEasy trailing-slash normalization.
Dogtag PKI ACME responder (Tomcat web.xml security constraints) URL pattern matching for admin-only endpoints (/v1/enable and /v1/disable) = Use a Servlet-spec compliant constraint that matches both the exact path and trailing-slash variants (prevent bypass via /v1/enable/).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18047?
The severity of CVE-2026-18047 is medium with a score of 6.5.
What type of vulnerability is CVE-2026-18047?
CVE-2026-18047 is an authentication bypass vulnerability affecting the Dogtag PKI ACME responder.
How can I exploit CVE-2026-18047?
An attacker can exploit CVE-2026-18047 by appending a trailing slash to the URL of the admin enable/disable endpoints.
How do I fix CVE-2026-18047?
To fix CVE-2026-18047, ensure proper URL pattern matching and validation to prevent the trailing slash bypass.
Which software is affected by CVE-2026-18047?
CVE-2026-18047 affects Dogtag PKI's ACME responder due to its URL pattern matching issue.