CVE-2026-80110
8.1 HIGHPublished 2026-09-21 · Updated 2026-09-22
AI risk analysis
- Summary
- The flaw in pki-core allows a wildcard ACL to override a more specific literal ACL, potentially allowing a lower-privileged group to perform actions intended for a higher-privileged group, compromising the certificate authority's issuance policy.
- Exploitability
- Exploitation requires knowledge of the affected API and the ability to craft a request that matches both a wildcard and a literal ACL. The precondition is that the Certificate Manager Agents group holds the lower-privileged permission.
- Blast radius
- If exploited, this vulnerability could lead to unauthorized changes in the certificate authority's issuance policy, impacting confidentiality and integrity.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Disable the affected v2 REST ACL filter or upgrade to the latest version of pki-core that addresses this issue.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
References
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.