# CVE-2026-76561: Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

Status: published. Published: 2026-09-08. Updated: 2026-11-02.

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

## Remediation

- workaround: Until a fixed package is available, restrict membership in CA Administrator and equivalent roles to fully trusted operators, and audit certificate profile import operations for unexpected or unrecognized profile content. Review any custom ExternalProcessConstraint executable configuration in Dogtag for unnecessary exposure. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (dogtag-pki): ≥ 0:11.9.0-5.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support (dogtag-pki): ≥ 0:11.6.0-3.el10_0.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (pki-core:10.6): ≥ 8100020260930154041.82f485b7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (pki-core): ≥ 0:11.7.1-2.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (pki-core): ≥ 0:11.3.0-3.el9_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions (pki-core): ≥ 0:11.5.0-3.el9_4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support (pki-core): ≥ 0:11.6.0-4.el9_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Certificate System 9 (pki-core): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (pki-core): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (pki-core): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (pki-core): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.2 (high); CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.73% as of 2026-11-01; percentile 54.25%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:73765 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:73766 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:75573 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:86621 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:86623 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:86624 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:86625 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-76561 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2519523 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-76561; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-76561; retrieved 2026-11-02; source updated Not reported

Revision: 201255544647981fbb86a3096d3db7836ca61a55e65ded85498ca57e0bb109b8

Canonical: https://y2.dev/cve/CVE-2026-76561