This vulnerability allows an unauthenticated client to query the PKI Certificate System's REST endpoint GET /ca/rest/securityDomain/hosts and receive a structured response that lists internal PKI/CA hosts, roles, and the security domain topology. The flaw results in unauthorized disclosure of sensitive infrastructure information, which can compromise confidentiality and potentially aid in planning subsequent attacks. The weakness aligns with CWE-200 (Information Exposure), CWE-284 (Improper Access Control), and CWE-497 (Improper Session Handling).

Affected products include Red Hat Certificate System 9 as well as Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. The CNA explicitly lists the impacted CPEs for each of these systems.

The CVSS score of 5.3 indicates a medium severity risk, while the EPSS score of < 1 % implies a very low probability of exploitation. The vulnerability is not present in the CISA KEV catalog. An attacker can exploit it by issuing an unauthenticated HTTP GET request to the exposed endpoint from any network that can reach the PKI service, with no authentication or session required. No vendor patch is currently available; the CNA provides only a workaround and recommends restricting network access to the REST API.