Red HatCVE-2026-53682

Red Hat Certificate System 9: system information exposure

CVE-2026-53682 · Published Sep 1, 2026 · updated Nov 5, 2026

Medium5.3

No fix yet

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.

Affected versions

Package	Affected	Fixed in
Red Hat Certificate System 9 Product	all versions	No fix yet
Red Hat Enterprise Linux 10 Product	all versions	No fix yet
Red Hat Enterprise Linux 6 Product	all versions	No fix yet
Red Hat Enterprise Linux 7 Product	all versions	No fix yet
Red Hat Enterprise Linux 8 Product	all versions	No fix yet
	all versions	No fix yet
Red Hat Enterprise Linux 9 Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-497, CWE-200, CWE-284

More Red Hat advisories

All Red Hat

Medium 6.4Sep 1

Red Hat Ansible Automation Platform: missing authorizationCVE-2026-84470no fix yet Medium 4.3Sep 1

Red Hat SFTP backend: uninitialized resourceCVE-2026-84267fixed in 1.60.2 High 8.8Sep 1

Red Hat gvfs: denial of serviceCVE-2026-84268fixed in 1.60.2 Medium 6.5Sep 1

Red Hat AFP backend: denial of serviceCVE-2026-84269fixed in 1.60.2 Medium 4.3Sep 1

Red Hat MTP backend: denial of serviceCVE-2026-84270fixed in 1.60.2 Medium 5.4Sep 1

Red Hat pulpcore: cross-site scriptingCVE-2026-84232no fix yet