HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-104988 — A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plug...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST use

Analysis

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can exploit this to obtain CA-signed certificates with arbitrary subject names. CVSS Score: 8.1. Published: 2026-10-02T20:17:01.370.

Indicators of Compromise (1)

CVE (1)
CVE-2026-104988
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 2, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108860 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo...

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

CVE-2026-108860
NIST NVD
MEDIUMVulnerability

The Luna Moth Files Weren’t Hacked. Here’s How They Leaked.

When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach. But they had. Here’s what we know. When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a... Source

DataBreaches.net
CRITICALVulnerability

NVD CRITICAL: CVE-2026-108753 — Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability ...

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVE-2026-108753
NIST NVD