CVE catalog

CVE-2026-104988

UBUNTU-CVE-2026-104988

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.20% · Oct 25, 2026

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntudogtag-pkipro10.2.6-1vulnerable
Ubuntudogtag-pkipro10.2.6-2vulnerable
Ubuntudogtag-pkipro10.2.6-3vulnerable
Ubuntudogtag-pkipro10.2.6+git20160317-1vulnerable
Ubuntudogtag-pkipro10.2.6+git20160317-1ubuntu0.1~esm1vulnerable
Ubuntudogtag-pkipro10.3.5+12-4ubuntu1vulnerable
Ubuntudogtag-pkipro10.3.5+12-5vulnerable
Ubuntudogtag-pkipro10.5.3-3vulnerable
Ubuntudogtag-pkipro10.5.3-4vulnerable
Ubuntudogtag-pkipro10.5.5-1vulnerable
Ubuntudogtag-pkipro10.6.0~beta2-3vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu1vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu2vulnerable
Ubuntudogtag-pkipro10.6.0-1ubuntu2+esm1vulnerable
Ubuntudogtag-pkipro10.7.3-4vulnerable
Ubuntudogtag-pkipro10.8.3-1ubuntu1vulnerable
Ubuntudogtag-pkipro10.8.3-1ubuntu1+esm1vulnerable
Ubuntudogtag-pkipro10.10.2-3build1vulnerable
Ubuntudogtag-pkipro11.0.0-1vulnerable
Ubuntudogtag-pkipro11.0.0-1ubuntu0.1~esm1vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]