REDHAT-BUG-2507956: Medium severity Dogtag PKI ACME responder vulnerability

Published Jul 28, 2026

Updated

A flaw was found in Dogtag PKI's ACME responder. The web.xml security constraints protecting the admin-only /v1/enable and /v1/disable endpoints use exact URL pattern matching (/v1/enable and /v1/disable). Due to a path normalization inconsistency between Tomcat's security constraint matching (which requires exact path match per Servlet spec §12.2) and RESTEasy's JAX-RS path routing (which normalizes trailing slashes), a request to /v1/enable/ bypasses the authentication constraint while still being routed to ACMEEnableService.handlePOST(). Neither ACMEEnableService nor ACMEDisableService performs application-level authorization checks — they directly call database.setEnabled(true/false). An unauthenticated remote attacker can exploit this to enable or disable ACME services, allowing persistent denial of service by repeatedly disabling the service, or re-enabling a service that was intentionally disabled by an administrator.

Affected Software

1 affected component

Dogtag PKI ACME responder

Event History

Jul 28, 2026

Data Sourced

via Red Hat·10:43 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it against a reachable Dogtag PKI ACME responder. The attacker does not need administrator credentials because the alternate trailing-slash paths bypass the configured authentication constraint.

What requests trigger the authorization bypass?

The affected routes are /v1/enable/ and /v1/disable/, with a trailing slash. Tomcat does not apply the exact-match constraints for /v1/enable and /v1/disable, while RESTEasy still routes the requests to the enable or disable handlers.

What is the practical impact?

An attacker can enable or disable ACME services. Repeatedly disabling the service can cause persistent denial of service, and enabling it can override an administrator's intentional disablement.

Is application-level authorization a fallback for these endpoints?

No. The ACME enable and disable service handlers directly change the enabled state in the database and do not perform their own authorization checks.

REDHAT-BUG-2507956: Medium severity Dogtag PKI ACME responder vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What requests trigger the authorization bypass?

What is the practical impact?

Is application-level authorization a fallback for these endpoints?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What requests trigger the authorization bypass?

What is the practical impact?

Is application-level authorization a fallback for these endpoints?