https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-06T18:10:49.172593+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-104988 fkie_cve-2026-104988 2026-10-06T18:10:49.208937+00:00

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.

 https://db.gcve.eu/vuln/ghsa-qgmm-v3v3-wff2 GHSA-qgmm-v3v3-wff2 2026-10-06T18:10:49.209018+00:00

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-104988 UBUNTU-CVE-2026-104988 2026-10-06T18:10:49.209050+00:00

Affected: Ubuntu:Pro:16.04:LTS: dogtag-pki, Ubuntu:Pro:18.04:LTS: dogtag-pki, Ubuntu:Pro:20.04:LTS: dogtag-pki, Ubuntu:Pro:22.04:LTS: dogtag-pki

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.