CVE-2026-18369 Red Hat CVE debrief

Who should care

Defenders responsible for Dogtag PKI servers, especially those with the InMemory database backend, and internal network services that could be targeted via SSRF, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-18369 allows unauthenticated SSRF in Dogtag PKI's ACME responder, potentially disclosing internal target response bodies. Defenders should verify exposure, prioritize remediation, and apply Red Hat advisories.

• Potential disclosure of internal target response bodies with InMemory database backend
• SSRF vulnerability allowing access to internal network services
• Need for verification of Dogtag PKI server exposure and internal service targeting
• Priority on applying Red Hat errata and security advisories

Technical summary

The Dogtag PKI's ACME responder accepts IP address literals as DNS identifiers and follows HTTP redirects without validating the target is a public address. This allows unauthenticated ACME account holders to perform SSRF, potentially disclosing internal target response bodies with the InMemory database backend. The vulnerability can be exploited to send HTTP GET requests to internal network services, potentially leading to unauthorized access and disclosure of sensitive information. Defenders should prioritize verifying exposure of Dogtag PKI servers and assess internal network services that could be targeted via SSRF.

Defensive priority

Defenders should prioritize verifying exposure of Dogtag PKI servers, especially those with the InMemory database backend, and assess internal network services that could be targeted via SSRF.

Recommended defensive actions

• Verify Dogtag PKI server exposure, especially with InMemory database backend
• Assess internal network services that could be targeted via SSRF
• Review and apply Red Hat errata and security advisories related to this CVE
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the flaw in Dogtag PKI's ACME responder. Red Hat has provided references to errata and security advisories related to this CVE. The vulnerability allows unauthenticated SSRF, potentially disclosing internal target response bodies with the InMemory database backend. Evidence is limited to public sources, and defenders should verify exposure and apply Red Hat advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.