CVE-2026-80110
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In pki-core, the v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw — intended to require Administrator-level profiles.create permission — to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group.
Risk Assessment
The vulnerability may allow lower-privileged users to modify the certificate authority's issuance policy. This poses a threat to the confidentiality and integrity of the certificate issuance policy.
Recommendation
Apply available pki-core updates that fix the ACL collision resolution logic. Until patched, consider restricting access to the profile-management REST API or auditing agent group permissions.
Other vulnerabilities in pki-core
See all- CVE-2015-0234High
Multiple temporary file creation vulnerabilities in pki-core version 10.2.0.
- CVE-2026-17039Low
A flaw was found in pki-core where the certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. This allows an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
Original NVD description (English source)
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS