CVE-2026-80110
Received Received - Intake

ACL Permission Bypass in pki-core

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-80110
EUVD
EUVD-2026-83919

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
redhat pki-core *
red_hat pki-core 11.6.0
red_hat pki-core 11.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in pki-core's v2 REST ACL filter. It incorrectly prioritizes wildcard permissions over more specific literal permissions when both match a request. For example, a wildcard permission like POST:{} (profiles.approve) overrides a literal permission like POST:raw (profiles.create). This allows lower-privileged users, such as Certificate Manager Agents, to bypass intended access restrictions and perform actions requiring higher privileges, like creating or enabling certificate profiles.

Detection Guidance

Check pki-core logs for unauthorized POST requests to /v2/profiles/raw by non-admin users. Review ACL configurations for misconfigured wildcard permissions overriding literal permissions. Use network monitoring to detect unexpected profile creation events in the CA.

Impact Analysis

If you are a Certificate Manager Agent or any user with profiles.approve permission, this flaw allows you to escalate privileges and perform actions restricted to administrators, such as creating or enabling arbitrary certificate profiles. This compromises the integrity of the Certificate Authority's issuance policy and could lead to unauthorized certificate issuance, affecting confidentiality and integrity of relying parties.

Compliance Impact

This vulnerability could lead to unauthorized certificate issuance, violating integrity and confidentiality requirements in GDPR and HIPAA. It undermines access control mechanisms, potentially exposing sensitive data or enabling non-compliant certificate issuance, which may result in regulatory penalties or loss of trust in the system.

Mitigation Strategies

Apply available updates from Red Hat. Restrict membership in the Certificate Manager Agents group to trusted users. Monitor for unauthorized profile creation or modification attempts. Disable the v2 REST API if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80110. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart