Dogtag PKI Certificate Profile Import Command Injection

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects Dogtag PKI's certificate profile import functionality, a critical component used by FreeIPA for certificate authority operations. The flaw allows authenticated users with CA Administrator privileges to bypass validation controls and inject arbitrary commands through the ExternalProcessConstraint mechanism. By crafting malicious profile content with attacker-controlled environment variables, an adversary can achieve remote code execution with the privileges of the pkiuser account. This is particularly dangerous because it exploits a trust boundary within the PKI infrastructure itself—an environment where certificate issuance and management occur—making it a high-value target for attackers seeking to compromise organizational trust anchors and potentially issue fraudulent certificates.

Casky's skill mapping across MITRE ATT&CK techniques TA0001 (Initial Access), TA0043 (Reconnaissance), and TA0002 (Execution) enables practitioners to detect the multi-stage attack pattern behind this CVE. The 447 matched skills, powered by Claude's extended reasoning, would identify reconnaissance activities probing for FreeIPA instances and CA Administrator account compromise (TA0001/TA0043), followed by the actual exploitation phase where malicious certificate profiles are uploaded to trigger ExternalProcessConstraint execution (TA0002). Practitioners using Casky would see correlated findings across profile import logs, environment variable manipulation patterns, and pkiuser process spawning anomalies—allowing them to recognize this attack chain before arbitrary code execution occurs and lateral movement within the PKI infrastructure begins.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76561.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-76561

Casky has 447 skills that investigate the attack patterns behind CVE-2026-76561. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn