CVE-2026-18047 in Certificate System
Summary
by MITRE • 07/28/2026
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability resides within the Dogtag PKI ACME responder implementation where improper web.xml security configuration creates a path traversal bypass opportunity. The flaw manifests through exact URL pattern matching that fails to account for trailing slash variations in HTTP request handling, specifically affecting admin-only endpoints responsible for enabling and disabling ACME service functionality. The issue stems from the interaction between Tomcat's authentication constraints and RESTEasy's routing mechanism where the former permits access to paths ending with a trailing slash while the latter correctly routes requests to appropriate handlers despite the bypassed authentication layer.
The technical exploitation occurs when an attacker appends a trailing slash to administrative URLs that should require authentication, allowing them to circumvent Tomcat's security constraints. This creates a condition where the web container's authorization rules are effectively bypassed while the underlying RESTEasy framework continues to process the request through its normal routing pipeline. The consequence is that unauthorized actors can invoke administrative functions without proper authentication credentials, specifically targeting endpoints designed to control ACME service state including activation and deactivation commands.
The operational impact of this vulnerability extends beyond simple privilege escalation into persistent denial of service scenarios. An attacker can repeatedly toggle the ACME service state, potentially causing service disruption for legitimate users while maintaining the ability to re-enable the service at will. This creates a significant threat vector for availability attacks where the service can be rendered unusable through repeated disabling operations, particularly problematic in environments where ACME functionality is critical for certificate management and automated provisioning processes.
This vulnerability aligns with CWE-639 Access Control Bypass and represents a specific implementation weakness in URL pattern matching within web application security configurations. The issue demonstrates how seemingly minor configuration details can create substantial security gaps, particularly when different components of the web stack handle authentication and routing independently. From an ATT&CK perspective, this maps to privilege escalation techniques through misconfigured access controls and can be classified under defensive evasion tactics where the attacker leverages legitimate administrative functions to disrupt service availability.
Mitigation strategies should focus on implementing more robust URL pattern matching in web.xml configurations that account for trailing slash variations and other path normalization issues. Security teams must ensure authentication constraints are properly enforced across all possible URL representations of administrative endpoints. Additionally, implementing proper input validation and canonical path resolution mechanisms within the application layer can prevent similar bypasses. Regular security testing should include verification of URL pattern matching behaviors in web applications, particularly focusing on edge cases involving trailing slashes and path normalization that could create unexpected access control gaps.