CVE-2026-53682: Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
Other sources
Description An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology / participating subsystems / hostnames). This is information disclosure at an authentication boundary: inventory/relationship metadata is exposed without requiring a principal, client cert, or session. An unauthenticated adversary with access to the network could enumerate PKI host/subsystem topology, target high-value Dogtag endpoints, or craft follow-on attacks (SSRF/pivots/phishing) using real internal names. Recommendations There is no reason to share the foreman version in the response and should be masked.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify Dogtag so GET /ca/rest/securityDomain/hosts cannot be called without requiring a principal, client certificate, or an active session (current behavior allows structured inventory responses without those).
Dogtag CA REST API Authentication/authorization requirement for endpoint GET /ca/rest/securityDomain/hosts = Require authentication (principal and/or client certificate/session) - Compensating control
Restrict network access to Dogtag CA REST endpoints (specifically GET /ca/rest/securityDomain/hosts) so unauthenticated clients from the network cannot reach the security domain hosts inventory endpoint.
- Compensating control
Ensure any version information (e.g., foreman version) returned in responses is masked/removed so it is not disclosed to unauthenticated clients.
Event History
Frequently Asked Questions
Who can retrieve the Security Domain host inventory?
Any unauthenticated client with network access to the Dogtag CA REST API can query the endpoint. No principal, client certificate, or session is required.
What information does the response expose?
The response provides structured Security Domain topology information, including internal PKI/CA hosts, participating subsystems, and their roles. It may give an attacker real internal names useful for targeting higher-value Dogtag endpoints or follow-on attacks.
Is a default unauthenticated deployment affected?
The exposed endpoint does not require authentication, so deployments where an unauthenticated client can reach the CA REST API are exposed. Restricting network access to that API limits who can query it.
What mitigation is identified if the response cannot be changed immediately?
Limit unauthenticated network access to the Dogtag CA REST API endpoint. The provided recommendation also says the foreman version should be masked in the response.