CVE-2026-80110 in Certificate System
Summary
by MITRE • 09/21/2026
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability resides within the pki-core component, specifically affecting the v2 REST Access Control List (ACL) filter mechanism used for authorization decisions in Red Hat Certificate System environments. This flaw represents a fundamental logic error in how permission conflicts are resolved when multiple ACL rules match an incoming request. In typical access control systems, permissions are often defined using both literal keys that target specific resources and wildcard patterns designed to apply broadly across resource groups or categories. The security model relies on the principle of least privilege and specificity, where more precise matches should take precedence over broader, generic ones to ensure fine-grained control. However, in this implementation, when a request triggers multiple ACL entries with colliding keys—one being a literal match and another a wildcard pattern—the system fails to evaluate which rule is more specific based on structural granularity or semantic intent.
Instead of performing a specificity-based comparison that would prioritize the exact literal key over the generalized wildcard key, the filter employs lexicographic string comparison as its tie-breaking mechanism. This approach compares ACL keys purely by their character sequence order rather than evaluating their scope or precision relative to the requested resource. Consequently, if the wildcard pattern happens to sort later in alphabetical order than the specific literal rule, it will be selected and applied. This logic flaw effectively allows a less privileged permission mapped via a wildcard to override a more restrictive but higher-privileged permission defined by a literal key when both rules are applicable to the same action. The root cause is not an input validation failure or buffer overflow, but rather a flawed authorization policy evaluation algorithm that misinterprets rule precedence based on string sorting order instead of access control best practices regarding specificity.
The operational impact of this vulnerability is significant for organizations relying on Red Hat Certificate System for their Public Key Infrastructure management. The most critical exploitation scenario involves the profile-management REST API endpoint POST /v2/profiles/raw, which is designed to create or modify certificate profiles and requires Administrator-level permissions such as profiles.create. Under normal circumstances, only users with explicit administrative privileges should be able to execute this action. However, due to the ACL filter flaw, a request intended for this high-privilege operation can instead be authorized under the lower-privileged profiles.approve permission. This override is particularly dangerous because it leverages permissions commonly held by default Certificate Manager Agents groups, which are often granted broader access levels to facilitate routine operational tasks but should not possess administrative capabilities like profile creation or modification.
This misauthorization allows unprivileged agents or compromised accounts within these agent groups to alter the certificate authority's issuance policy without proper oversight. By modifying profiles through this unauthorized pathway, an attacker can change parameters such as key usage restrictions, validity periods, signature algorithms, and enrollment requirements for certificates issued by the CA. This directly compromises the integrity of the PKI infrastructure, potentially enabling the creation of maliciously configured certificates that bypass security controls or trust boundaries. Furthermore, because these changes affect how future certificates are generated, the confidentiality aspect is also impacted as attackers may manipulate policies to issue certificates with weaker cryptographic settings or extended lifetimes, facilitating long-term persistence and lateral movement within a network environment dependent on certificate-based authentication.
From an industry standard perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting issues related to authorization bypass through flawed logic in access control lists. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource, as the system incorrectly assigns a lower-level permission where a higher-level one was intended based on structural specificity. In terms of threat modeling and adversary behavior, this flaw facilitates techniques associated with ATT&CK T1098 Account Manipulation or potentially T1484 Domain Policy Modification if applied to Active Directory contexts, though in the PKI context it represents unauthorized policy modification akin to T1578 Delete Cloud Instances or more accurately T1652 Misuse of Configuration Files. The ability to alter issuance policies effectively undermines the trust model upon which public key infrastructure relies, making this a high-severity issue for any deployment where agent groups have elevated but non-administrative roles.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to apply vendor-provided patches that update the pki-core package to versions where the ACL filter logic has been corrected to prioritize literal matches over wildcard patterns based on specificity rather than lexicographic order. Organizations should verify their current version against known vulnerable ranges provided by Red Hat or relevant distribution maintainers and schedule updates during maintenance windows. In addition to patching, administrators should review existing ACL configurations for any custom rules that might rely on the previous flawed behavior, ensuring that no legitimate workflows were inadvertently broken by stricter specificity enforcement.
Beyond software updates, defense-in-depth measures are recommended to limit the blast radius of such vulnerabilities. Principle of least privilege dictates that Certificate Manager Agent groups should be granted only the minimum permissions necessary for their operational functions, avoiding broad wildcard assignments where possible. Regular audits of ACL rules and profile configurations can help detect unauthorized changes early. Implementing robust logging and monitoring on REST API endpoints, particularly those handling sensitive operations like POST /v2/profiles/raw, allows security teams to identify anomalous authorization events that may indicate exploitation attempts. By combining timely patching with rigorous access control reviews and continuous monitoring, organizations can effectively neutralize the risks posed by this ACL logic flaw and maintain the integrity of their certificate authority infrastructure.