CVE catalog
CVE-2026-18047
UBUNTU-CVE-2026-18047
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.49% · Oct 25, 2026
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | dogtag-pki | 11 | 10.10.2-3 | vulnerable |
| Debian | dogtag-pki | 11 | 10.10.6-1 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.0-1 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.3-1 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.3-2 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.3-3 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.3-4 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.6-1 | vulnerable |
| Debian | dogtag-pki | 11 | 11.0.6-2 | vulnerable |
| Debian | dogtag-pki | 11 | 11.2.1-1 | vulnerable |
| Debian | dogtag-pki | 11 | 11.2.1-2 | vulnerable |
| Ubuntu | dogtag-pki | pro | 10.10.2-3build1 | vulnerable |
| Ubuntu | dogtag-pki | pro | 11.0.0-1 | vulnerable |
| Ubuntu | dogtag-pki | pro | 11.0.0-1ubuntu0.1~esm1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: