CVE-2026-18369
Received Received - Intake

Dogtag PKI ACME Responder SSRF via IP Literal Validation

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: redhat-SADP

Description
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-18369
EUVD
EUVD-2026-51078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat dogtag_pki *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18369 is a Server-Side Request Forgery (SSRF) vulnerability in Dogtag PKI's ACME responder. The flaw occurs because the HTTP-01 challenge validator accepts IP addresses as valid DNS identifiers without checking if they are public. This allows unauthenticated ACME users to force the server to send HTTP requests to internal services. The validator also follows HTTP redirects blindly, enabling access to restricted network ranges like loopback or private addresses.

Detection Guidance

To detect this vulnerability, monitor HTTP-01 challenge logs in Dogtag PKI's ACME responder for requests involving IP literals or internal addresses. Check for unusual outbound HTTP GET requests from the server to internal endpoints. Review ACME challenge error responses for exposed internal service data.

Impact Analysis

An attacker could exploit this to access internal network services, potentially stealing sensitive data or interacting with internal APIs. With the InMemory database backend, the attacker may receive the full HTTP response from internal targets through ACME challenge errors. Even with other backends, the server logs may expose internal responses.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of internal service responses may result in data breaches, triggering compliance investigations and potential fines under these regulations.

Mitigation Strategies

Apply the latest patches for Dogtag PKI from Red Hat. Disable HTTP-01 challenge validation for non-public addresses by updating ACMEIdentifierValidator.validateSyntaxDNS() and ACMEPolicy.validateIdentifier(). Configure the HTTP client to disable automatic redirect following or validate redirect targets strictly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart