CVE-2026-18369 Red Hat CVE debrief

Who should care

Defenders responsible for Dogtag PKI deployments, especially those using InMemory database backends, should assess their exposure and verify internal network services that may be targeted by SSRF attacks.

Why it matters

Defenders should prioritize verifying exposure of Dogtag PKI ACME responders and assessing internal network services due to the potential for SSRF attacks and response body disclosure.

• Potential disclosure of internal target response bodies through ACME challenge errors
• SSRF attacks against internal network services
• Verification of Dogtag PKI ACME responder exposure and configuration
• Assessment of internal network services for potential targeting by SSRF attacks

Technical summary

The Dogtag PKI ACME responder does not properly validate DNS identifiers and follows HTTP redirects without validating target addresses. This allows unauthenticated ACME account holders to perform SSRF attacks, potentially disclosing response bodies of internal targets when using the InMemory database backend. The flaw is in the ACME responder's validation and redirect handling, allowing SSRF and potential response body disclosure in certain configurations. Defenders should prioritize verifying exposure and assessing internal network services.

Defensive priority

Defenders should prioritize verifying exposure of Dogtag PKI ACME responders, especially those with InMemory database backends, and assess internal network services that may be targeted by SSRF attacks.

Recommended defensive actions

• Verify exposure of Dogtag PKI ACME responders, especially those with InMemory database backends
• Assess internal network services that may be targeted by SSRF attacks
• Review and apply Red Hat errata and security advisories related to this vulnerability
• Confirm whether affected Dogtag PKI deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in Dogtag PKI's ACME responder. Red Hat has provided errata and security advisories related to this vulnerability. Evidence is limited to public CVE and NVD details. Defenders should verify exposure using official advisories and assess internal services for potential targeting by SSRF attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.