CVE-2026-114406

Published: October 22, 2026Last modified: October 23, 2026

Description

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Severity score breakdown

Parameter	Value
Base score	6.8
Attack Vector	NETWORK
Attack complexity	HIGH
Privileges required	NONE
User interaction	REQUIRED
Scope	UNCHANGED
Confidentiality	HIGH
Integrity impact	HIGH
Availability impact	NONE
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Status

Product	Release	Package	Status
Alpaquita Linux	23 LTS	ca-certificates	Fixed (20261020-r0)
	25 LTS	ca-certificates	Fixed (20261020-r0)
	Stream	ca-certificates	Fixed (20261020-r0)
Hardened Containers	23 LTS	ca-certificates	Fixed (20261020-r0)
	25 LTS	ca-certificates	Fixed (20261020-r0)
	Stream	ca-certificates	Fixed (20261020-r0)

CVE-2026-114406

Description

Severity score breakdown

Status

References