The vulnerability in pki-core’s v2 REST ACL filter uses lexicographic comparison to break ties between literal and wildcard ACL entries, allowing a lower-privileged wildcard permission to override a more specific literal permission. In the Certificate Authority’s profile-management REST API this flaw lets a request that targets POST /v2/profiles/raw, which should require Administrator-level profiles.create permission, be authorized with the lower-privileged profiles.approve permission that all users in the default Certificate Manager Agents group possess. The result is that an attacker who controls a Certificate Manager Agent can create arbitrary raw certificate profiles and therefore manipulate the CA’s issuance policy, compromising the confidentiality and integrity of the certificate authority.

The flaw affects Red Hat Certificate System 9 and all supported Red Hat Enterprise Linux releases from version 6 through 10. The CNA lists every major RHEL distribution as impacted, but does not specify particular sub-versions; it is safe to assume that any installation that includes the default Certificate Manager Agents group and runs the vendor’s pki-core package is vulnerable.

The CVSS score of 8.1 marks this as a high-severity privilege escalation vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, so no immediate supply-chain exploit evidence has been reported, but the attack requires only an authenticated credential in the Certificate Manager Agents group, which is a role that many users may routinely get granted. An attacker who successfully creates raw profiles can subvert issuance policies, potentially leading to unauthorized certificate issuance or supply-chain compromise. The lack of an immediate patch means that organizations must rely on the CNA-recommended workaround until an update is released.