CVEvulnerability

CVE-2026-53682

5.3 MEDIUM Published 2026-09-01 Modified 2026-09-23 Official page ↗
Status
Awaiting Analysis
Published
2026-09-01
Last modified
2026-09-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-284, CWE-497

Description

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-284 Improper Access Control weakness
  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References