CVE-2026-17039
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A flaw was found in pki-core where the certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. This allows an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Risk Assessment
The organization is at risk of unauthorized certificate renewal across realms, potentially compromising the integrity and confidentiality of communications in different administrative zones.
Recommendation
Apply the vendor-supplied patch for pki-core immediately and review the realm-based access control configuration.
Other vulnerabilities in pki-core
See all- CVE-2015-0234High
Multiple temporary file creation vulnerabilities in pki-core version 10.2.0.
- CVE-2026-80110High
In pki-core, the v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw — intended to require Administrator-level profiles.create permission — to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group.
Original NVD description (English source)
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS