CVE-2026-53682 in PKI
Summary
by MITRE • 09/01/2026
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability described constitutes an unauthenticated information disclosure flaw within the Red Hat Certificate System infrastructure, specifically affecting the REST API endpoint GET /ca/rest/securityDomain/hosts. This security deficiency allows any remote actor with network access to the affected system to retrieve sensitive internal topology data without providing valid credentials or presenting a client certificate. The core technical issue lies in the absence of proper authentication and authorization checks on this specific administrative interface, which is intended for managing Security Domain configurations but remains exposed to unauthenticated queries due to misconfigured security constraints or missing role-based access control enforcement.
The operational impact of this vulnerability is significant as it facilitates reconnaissance activities by attackers seeking to map the internal Public Key Infrastructure environment. By querying this endpoint, an attacker can obtain a structured list of all hosts participating in the Security Domain along with their assigned roles and subsystems. This information reveals critical details about the organization's PKI architecture, including which servers act as Certificate Authorities, which serve as Registration Agents, and how these components are interconnected. Such visibility into the security domain topology enables adversaries to identify high-value targets for subsequent attacks, such as targeting specific CA hosts with known vulnerabilities or attempting lateral movement within the internal network based on the revealed host relationships.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-863: Incorrect Authorization, as it involves the exposure of sensitive information due to insufficient access control mechanisms. In terms of offensive security frameworks, this activity corresponds to ATT&CK technique T1592.004: Gather Victim Host Information - Network Service Discovery, where attackers enumerate services to understand the environment before launching more targeted exploits. The lack of authentication on an administrative API endpoint represents a fundamental failure in defense-in-depth strategies, allowing unauthenticated actors to gain insights that should be restricted to authorized administrators only.
Mitigation for this issue requires immediate implementation of strict access controls on all REST API endpoints within the Certificate System. Administrators must ensure that the security domain management interfaces require valid authentication, such as client certificates or session-based tokens, before processing any requests. Additionally, network-level restrictions should be applied to limit access to these administrative ports and paths exclusively to trusted management networks or jump hosts. Regular auditing of API endpoint configurations is essential to prevent similar misconfigurations in other subsystems, ensuring that all sensitive internal APIs adhere to the principle of least privilege and require explicit authorization for every operation.