{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core","product":"Red Hat Certificate System 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"dogtag-pki","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core:10.6/pki-core","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pki-core","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-53682","cwes":["CWE-497","CWE-200","CWE-284"],"description":"An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.","epss":{"date":"2026-11-05","percentile":0.1117,"score":0.00209},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793914991870,"publishedAt":1788266270827,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-53682"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487511"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Remove unnecessary version and topology details from the unauthenticated response."}],"revision":"9cb9e1374f55042511c8c82828233477204664da77ae79e12faa7b9ca0e3302a","sources":[{"modifiedAt":1793914991870,"name":"CNA: redhat","retrievedAt":1793917141251,"url":"https://www.cve.org/CVERecord?id=CVE-2026-53682"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917159617,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53682"}],"ssvc":{"assessedAt":1788276402543,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts","updatedAt":1793917159617}