Live › vulnerability › CVE-2026-114406
Go to dashboardThe system certificate authority store shipped in Red Hat ca-certificates packages trusted root CAs that signed intermediate CAs with weak private keys issued by eMudhra. A man-in-the-middle attacker could use those intermediates to issue certificates for arbitrary host names that TLS clients using the system store would trust, sending clients to malicious sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems on Red Hat products that use the system CA store through ca-certificates RPM packages are affected, since TLS clients on those systems trust the bundled roots. The sources do not say which Red Hat releases are impacted, and systems that do not rely on the system CA store for TLS trust are less exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
This page as .md · .json · in your agent: get_signal("CVE-2026-114406")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.