CVE-2026-18047

Name of the Vulnerable Software and Affected Versions Dogtag PKI (affected versions not specified)

Description A flaw in the ACME responder allows an unauthenticated attacker to bypass Tomcat authentication constraints. This occurs because the web.xml security constraints use exact URL pattern matching for admin-only endpoints. By appending a trailing slash to the URL, requests are still routed to the handler by RESTEasy, enabling unauthorized toggling of the ACME service state, which can lead to a persistent denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.