Understanding and Defending Against CVE-2026-80110: A Critical Vulnerability in pki-core

Overview

CVE-2026-80110 is a critical vulnerability in the pki-core package, which is used in Red Hat Certificate System and several versions of Red Hat Enterprise Linux. This vulnerability affects the v2 REST ACL filter, allowing a lower-privileged user to override more specific permissions, potentially leading to unauthorized changes in the certificate authority's issuance policy. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 8.1, indicating a high level of severity.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability lies in the way the v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys. Instead of using specificity, it uses lexicographic string comparison, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. This is a design issue, classified under CWE-863 (Incorrect Authorization).

Attack Surface & Vector

The attack surface for this vulnerability is the profile-management REST API in the CA. An attacker needs to send a POST request to /v2/profiles/raw, which is intended to require Administrator-level profiles.create permission. However, due to the vulnerability, this request can be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The attack vector is network-adjacent, and the attacker needs low privileges.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate Certificate Authority 1. Initial Position: An attacker gains access to the network with a low-privileged account that has the profiles.approve permission. 2. Triggering the Flaw: The attacker crafts a POST request to /v2/profiles/raw with a specially designed payload that exploits the vulnerability in the v2 REST ACL filter. 3. What Breaks: The security boundary fails because the wildcard-mapped permission (profiles.approve) overrides the more specific literal-mapped permission (profiles.create), allowing the attacker to create a new profile without having the required Administrator-level permission. 4. Attacker's Prize: The attacker gains the ability to make unauthorized changes to the certificate authority's issuance policy, potentially leading to the issuance of malicious certificates.

Real-World Impact

The exploitation of this vulnerability can have severe consequences, including unauthorized changes to the certificate authority's issuance policy, potentially leading to the issuance of malicious certificates. This can compromise the confidentiality and integrity of the certificate authority's issuance policy.

Detection & Defense

Immediate Mitigations

To mitigate this vulnerability, it is recommended to upgrade to the latest version of pki-core that includes the fix. Specifically, Red Hat has released patches for affected versions of Red Hat Enterprise Linux and Red Hat Certificate System.

Detection Strategies

Defenders can detect exploitation attempts by monitoring for unusual activity in the profile-management REST API, such as unexpected POST requests to /v2/profiles/raw. Implementing a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can also help detect and prevent exploitation attempts.

Long-Term Hardening

To prevent similar vulnerabilities in the future, it is essential to implement a defense-in-depth strategy, including: - Regularly updating and patching software - Implementing strict access controls and permissions - Monitoring for unusual activity - Using a WAF or IDS to detect and prevent exploitation attempts

Key Takeaways

* CVE-2026-80110 is a high-severity vulnerability in the pki-core package that affects Red Hat Certificate System and several versions of Red Hat Enterprise Linux. * The vulnerability allows a lower-privileged user to override more specific permissions, potentially leading to unauthorized changes in the certificate authority's issuance policy. * Understanding the root cause, attack surface, and exploitation mechanics of this vulnerability is crucial for defenders to implement effective mitigations. * Implementing a defense-in-depth strategy, including regular updates, strict access controls, and monitoring, can help prevent similar vulnerabilities in the future.

Sources

* National Vulnerability Database (NVD) - CVE-2026-80110 * Red Hat Security Advisory - CVE-2026-80110