CVE-2026-104988

Summary

The CMCAuthForEST authentication plugin in Dogtag PKI fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate, allowing an authenticated user to obtain CA-signed certificates with arbitrary subject names.

Exploitability

Exploitation requires an authenticated user with BasicAuth access to the EST service, making it moderately exploitable.

Blast radius

If exploited, this flaw could allow an attacker to issue certificates with any subject name, potentially leading to unauthorized certificate issuance and misuse.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the CMCAuthForEST authentication plugin or restrict access to the EST service to require end-user TLS client certificates.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.