CVE-2026-17039
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A flaw was found in pki-core where the certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. This allows an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Risk Assessment
The organization is at risk of unauthorized certificate renewal across realms, potentially compromising the integrity and confidentiality of communications in different administrative zones.
Recommendation
Apply the vendor-supplied patch for pki-core immediately and review the realm-based access control configuration.
Original NVD description (English source)
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.