CVE-2026-53682 Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
Unauthenticated attackers can access the Security Domain hosts inventory via the REST API, exposing internal PKI topology and subsystem roles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53682?
CVE-2026-53682 is a medium-severity vulnerability in Red Hat Certificate System 9, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
Which versions are affected by CVE-2026-53682?
How do I fix CVE-2026-53682?
No fix has been published for CVE-2026-53682 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-53682 being exploited?
There is no known exploitation of CVE-2026-53682 in the wild and no public exploit code.
Sources
Also known as GHSA-cvf8-gvvm-fg6c, UBUNTU-CVE-2026-53682.