CVE-2026-18369 in Certificate System
Summary
by MITRE • 07/30/2026
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within Dogtag PKI's ACME responder implementation where a critical flaw in the HTTP-01 challenge validation process creates an avenue for server-side request forgery attacks. The technical weakness stems from the validator's acceptance of IP address literals as DNS identifiers, which violates standard certificate validation practices and creates an unexpected attack surface. When an attacker submits a challenge response containing an IP address literal instead of a proper DNS name, the system proceeds with validation without proper sanitization or address type verification. This behavior directly contravenes industry standards such as cwe-915 where insufficient validation of input parameters leads to unauthorized access patterns.
The operational impact of this vulnerability is significant as it allows unauthenticated attackers to leverage the Dogtag server's network connectivity to make HTTP GET requests to internal services that would otherwise be protected by network segmentation. The system follows HTTP redirects without validating whether the redirect target resolves to a public address, creating an environment where internal network resources become accessible through the PKI server's outbound connections. This presents a classic server-side request forgery scenario where the attacker can enumerate internal services and potentially extract sensitive information from responses that are normally restricted from external access.
The security implications extend beyond simple information disclosure when considering the InMemory database backend configuration, which inadvertently exposes response bodies of internal targets through ACME challenge error messages. This creates a data leakage vector where attackers can harvest sensitive information from internal services such as web applications, databases, or other networked systems that respond to HTTP requests. The vulnerability aligns with attack techniques documented in the attack pattern taxonomy under server-side request forgery categories, specifically targeting the manipulation of HTTP request routing through validation bypass mechanisms.
Mitigation strategies should focus on implementing strict input validation for DNS identifier fields within the ACME responder, ensuring that IP address literals are rejected during challenge validation and that all redirects are properly validated against public address ranges. Network segmentation controls should be enforced to limit outbound connectivity from the PKI server, while proper logging of all HTTP requests initiated by the system should be implemented to detect unauthorized access attempts. Additionally, configuration management practices should prevent the deployment of vulnerable InMemory database backends in production environments where information disclosure risks are unacceptable. The fix should incorporate address type validation and redirect target verification mechanisms that align with established security frameworks such as those recommended by nist 800-53 for secure network design principles.