CVE-2026-18369: Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
Other sources
A flaw was found in Dogtag PKI's ACME responder. The HTTP-01 challenge validator accepts IP address literals (e.g. 127.0.0.1) as dns identifiers without validating that the target address is public. Combined with the default Apache HttpClient behavior of following HTTP redirects, an unauthenticated ACME account holder can force the Dogtag server to send HTTP GET requests to arbitrary internal HTTP endpoints (loopback, link-local, RFC 1918, cloud metadata). When the InMemory database backend is used, the full HTTP response body of the internal target is included in the ACME challenge error and returned to the client, enabling the attacker to read internal HTTP responses. On DS/LDAP and PostgreSQL backends, the SSRF still occurs but the response body is only written to server logs, not returned to the client. The vulnerability exists because ACMEIdentifierValidator.validateSyntaxDNS() treats IP octets as valid DNS labels, ACMEPolicy.validateIdentifier() does not filter non-public addresses, and HTTP01Validator.getResponse() uses HttpClients.createDefault() which follows redirects without validating the destination address.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify Dogtag PKI ACME HTTP-01 challenge validation so that ACMEIdentifierValidator.validateSyntaxDNS() does NOT treat IP octets as valid DNS labels (i.e., reject IP address literals / non-DNS identifiers).
Dogtag PKI ACME responder (HTTP-01 validator) ACMEIdentifierValidator.validateSyntaxDNS() - IP address literals treated as DNS identifiers = Reject IP address literals as DNS identifiers - Configuration
Update ACMEPolicy.validateIdentifier() so identifiers that are non-public (e.g., loopback, link-local, RFC 1918, cloud metadata ranges) are rejected rather than allowed.
Dogtag PKI ACME responder (HTTP-01 validator) ACMEPolicy.validateIdentifier() - non-public address filtering = Filter and reject non-public addresses - Configuration
Change HTTP01Validator.getResponse() so it does not use HttpClients.createDefault() behavior that follows redirects; prevent redirect following or validate the redirect destination is a public address before sending follow-up HTTP GET requests.
Dogtag PKI ACME responder (HTTP-01 validator) HTTP client redirect behavior in HTTP01Validator.getResponse() = Do not follow HTTP redirects without validating the destination address - Compensating control
Restrict network egress from the Dogtag server hosting the ACME responder so it cannot reach internal HTTP endpoints (loopback, link-local, RFC 1918, and cloud metadata services), reducing SSRF impact.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18369?
The severity of CVE-2026-18369 is rated as medium with a score of 5.8.
How do I fix CVE-2026-18369?
To fix CVE-2026-18369, update your Dogtag PKI to the latest version where the vulnerability is addressed.
What type of attack does CVE-2026-18369 exploit?
CVE-2026-18369 exploits server-side request forgery (SSRF) vulnerabilities.
Who can exploit CVE-2026-18369?
An unauthenticated ACME account holder can exploit CVE-2026-18369.
What is the impact of CVE-2026-18369 on system security?
The impact of CVE-2026-18369 can allow unauthorized exploitation of internal resources by redirecting HTTP requests.