Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-114406

Trusted weak eMudhra intermediates in Red Hat system CA store

CVSS 3.1
6.8 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-114406 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Red Hat’s system CA store, shipped in ca-certificates RPM packages, included root CAs that signed eMudhra intermediate certificates with weak private keys. A network man-in-the-middle attacker can present host certificates signed by those intermediates; TLS clients that trust the system store may accept them and connect to malicious sites if the user proceeds. Red Hat is removing the parent root CAs because clients cannot distrust only the weak intermediates.

What to do: Apply Red Hat’s update for CVE-2026-114406, which removes the root CAs that signed the weak eMudhra intermediates from the system CA store.

ProductAffected
Red Hat ca-certificates (system CA store)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Weakness
CWE-295
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story