CVE-2026-114406

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Published Oct 21, 2026 CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Description
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.

Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Remediation

Vendor Workaround

See the security bulletin for a detailed mitigation procedure.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:86595 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88455 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88459 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88550 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88560 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88563 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88564 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88662 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88668 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88669 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:88779 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89081 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89131 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89197 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89232 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89333 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89651 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89714 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89725 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89838 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:89907 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:90272 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:90969 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:90985 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91202 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91204 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91206 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91207 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91217 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91218 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91219 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91224 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91232 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91233 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91234 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91235 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91236 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91237 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91238 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91241 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91242 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91243 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91244 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91245 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91246 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91248 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91249 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:91997 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:92006 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:92342 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:93043 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:93044 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:93045 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:93046 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94459 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94468 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94474 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94476 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94581 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94583 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94584 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94631 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94702 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94715 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94717 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94721 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94738 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:94802 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95058 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95090 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95264 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95365 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95745 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:95872 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96282 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96323 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96333 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96391 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96400 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96403 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:96406 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99044 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99787 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99792 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99794 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99796 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:99800 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-114406 cve-icon cve-icon
https://access.redhat.com/security/vulnerabilities/RHSB-2026-012 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2556046 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-114406 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-114406 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1 cpe:/a:redhat:rhdh:1.10::el9
cpe:/a:redhat:rhdh:2.1::el10
References
Type Values Removed Values Added
First Time appeared Redhat cost Management
Redhat cost Management On Premise
CPEs cpe:/a:redhat:cost_management:4::el9
cpe:/a:redhat:cost_management_on_premise:1::el10
cpe:/a:redhat:rhdh:2
Vendors & Products Redhat cost Management
Redhat cost Management On Premise
References
Type Values Removed Values Added
First Time appeared Redhat rhdh
Redhat service Interconnect
CPEs cpe:/a:redhat:rhdh:1
cpe:/a:redhat:service_interconnect:2.0::el9
Vendors & Products Redhat rhdh
Redhat service Interconnect
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.11::el9
References
Type Values Removed Values Added
First Time appeared Redhat discovery
Redhat windows Machine Config
CPEs cpe:/a:redhat:discovery:2::el9
cpe:/a:redhat:windows_machine_config:11.0::el9
Vendors & Products Redhat discovery
Redhat windows Machine Config
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat openstack
CPEs cpe:/a:redhat:openstack:13::el7
cpe:/a:redhat:openstack:16.2::el8
cpe:/a:redhat:openstack:17.1::el9
cpe:/a:redhat:openstack:18.0::el9
Vendors & Products Redhat openstack
References
Type Values Removed Values Added
First Time appeared Redhat ai Inference Server
Redhat enterprise Linux Ai
CPEs cpe:/a:redhat:ai_inference_server:3
cpe:/a:redhat:enterprise_linux_ai:3
cpe:/a:redhat:openshift_ai
Vendors & Products Redhat ai Inference Server
Redhat enterprise Linux Ai
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5
Type Values Removed Values Added
First Time appeared Redhat openshift Ai
Redhat openshift Devspaces
CPEs cpe:/a:redhat:advanced_cluster_security:4 cpe:/a:redhat:advanced_cluster_security:4.10::el8
cpe:/a:redhat:openshift_ai:3.0::el9
cpe:/a:redhat:openshift_ai:3.4::el9
cpe:/a:redhat:openshift_ai:3.5::el9
cpe:/a:redhat:openshift_devspaces:3.31::el10
cpe:/a:redhat:openshift_devspaces:3.31::el9
Vendors & Products Redhat openshift Ai
Redhat openshift Devspaces
References
Type Values Removed Values Added
First Time appeared Redhat agentic Cluster Security Suite
Redhat rhui
CPEs cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9
cpe:/a:redhat:rhui:5::el9
Vendors & Products Redhat agentic Cluster Security Suite
Redhat rhui
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
cpe:/a:redhat:openshift:4.20::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:6
cpe:/a:redhat:openshift:4.12::el8
cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift:4.18::el9
cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:satellite:6
Vendors & Products Redhat satellite
Type Values Removed Values Added
First Time appeared Redhat openshift Builds
CPEs cpe:/a:redhat:openshift_builds:1.8::el9
cpe:/a:redhat:openshift_builds:1.9::el10
Vendors & Products Redhat openshift Builds
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References
Type Values Removed Values Added
First Time appeared Redhat openshift Gitops
CPEs cpe:/a:redhat:openshift_gitops:1
Vendors & Products Redhat openshift Gitops
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel Eus Long Life
CPEs cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Vendors & Products Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
CPEs cpe:/o:redhat:rhel_aus:8.4::baseos
Vendors & Products Redhat rhel Aus
References
Type Values Removed Values Added
First Time appeared Redhat rhel Tus
CPEs cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Tus
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel E4s
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
cpe:/o:redhat:rhel_e4s:9.4::baseos
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8::baseos
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2
cpe:/a:redhat:assisted_installer:2
cpe:/a:redhat:cert_manager:1
cpe:/a:redhat:confidential_compute_attestation:1
cpe:/a:redhat:connectivity_link:1
cpe:/a:redhat:container_native_virtualization:4
cpe:/a:redhat:container_native_virtualization:5
cpe:/a:redhat:kernel_module_management:2
cpe:/a:redhat:kube_descheduler_operator:5
cpe:/a:redhat:logging:6
cpe:/a:redhat:lvms:4
cpe:/a:redhat:lvms:5
cpe:/a:redhat:migration_toolkit_applications:8
cpe:/a:redhat:migration_toolkit_virtualization:2
cpe:/a:redhat:multicluster_engine
cpe:/a:redhat:network_observ_optr:1
cpe:/a:redhat:openshift_distributed_tracing:3
cpe:/a:redhat:quay:3
cpe:/a:redhat:rhmt:1
cpe:/a:redhat:serverless:1
cpe:/a:redhat:service_mesh:3
cpe:/a:redhat:windows_machine_config
Vendors & Products Redhat acm
Redhat assisted Installer
Redhat cert Manager
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat container Native Virtualization
Redhat kernel Module Management
Redhat kube Descheduler Operator
Redhat logging
Redhat lvms
Redhat migration Toolkit Applications
Redhat migration Toolkit Virtualization
Redhat multicluster Engine
Redhat network Observ Optr
Redhat openshift Distributed Tracing
Redhat quay
Redhat rhmt
Redhat serverless
Redhat service Mesh
Redhat windows Machine Config
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:10.2
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
Description The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Title Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
First Time appeared Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat assisted Installer
Redhat cert Manager
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat container Native Virtualization
Redhat enterprise Linux
Redhat hummingbird
Redhat kernel Module Management
Redhat kube Descheduler Operator
Redhat logging
Redhat lvms
Redhat migration Toolkit Applications
Redhat migration Toolkit Virtualization
Redhat multicluster Engine
Redhat network Observ Optr
Redhat openshift
Redhat openshift Distributed Tracing
Redhat quay
Redhat rhmt
Redhat satellite
Redhat serverless
Redhat service Mesh
Redhat windows Machine Config
Weaknesses CWE-295
CPEs cpe:/a:redhat:acm:2
cpe:/a:redhat:advanced_cluster_security:4
cpe:/a:redhat:assisted_installer:2
cpe:/a:redhat:cert_manager:1
cpe:/a:redhat:confidential_compute_attestation:1
cpe:/a:redhat:connectivity_link:1
cpe:/a:redhat:container_native_virtualization:4
cpe:/a:redhat:container_native_virtualization:5
cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:kernel_module_management:2
cpe:/a:redhat:kube_descheduler_operator:5
cpe:/a:redhat:logging:6
cpe:/a:redhat:lvms:4
cpe:/a:redhat:lvms:5
cpe:/a:redhat:migration_toolkit_applications:8
cpe:/a:redhat:migration_toolkit_virtualization:2
cpe:/a:redhat:multicluster_engine
cpe:/a:redhat:network_observ_optr:1
cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift_distributed_tracing:3
cpe:/a:redhat:quay:3
cpe:/a:redhat:rhmt:1
cpe:/a:redhat:satellite:6
cpe:/a:redhat:serverless:1
cpe:/a:redhat:service_mesh:3
cpe:/a:redhat:windows_machine_config
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat assisted Installer
Redhat cert Manager
Redhat confidential Compute Attestation
Redhat connectivity Link
Redhat container Native Virtualization
Redhat enterprise Linux
Redhat hummingbird
Redhat kernel Module Management
Redhat kube Descheduler Operator
Redhat logging
Redhat lvms
Redhat migration Toolkit Applications
Redhat migration Toolkit Virtualization
Redhat multicluster Engine
Redhat network Observ Optr
Redhat openshift
Redhat openshift Distributed Tracing
Redhat quay
Redhat rhmt
Redhat satellite
Redhat serverless
Redhat service Mesh
Redhat windows Machine Config
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}