{"id":"CVE-2026-114406","kind":"vulnerability","aliases":["CVE-2026-114406"],"related":[],"title":"Red Hat CA store: weak eMudhra intermediates let attackers impersonate TLS sites","description":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.","summary":"The system certificate authority store shipped in Red Hat ca-certificates packages trusted root CAs that signed intermediate CAs with weak private keys issued by eMudhra. A man-in-the-middle attacker could use those intermediates to issue certificates for arbitrary host names that TLS clients using the system store would trust, sending clients to malicious sites.","severity":"medium","cvss":6.8,"epss":0.00273,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ca-certificates","infrastructure","linux","red-hat","rhel","tls"],"not_affected_if":["custom-trust-store","non-red-hat-systems"],"how_to_check":"- unknown","fix":"- Update the ca-certificates RPM packages to the fixed build Red Hat publishes for CVE-2026-114406 (the sources do not name the version)\n- Confirm the affected root CAs are removed from the system trust store after the update","status":"open","published_at":"2026-10-21T21:17:58+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:42:56+00:00","updated_at":"2026-10-25T03:42:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:42:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ca-certificates RPM packages to the fixed build Red Hat publishes for CVE-2026-114406 (the sources do not name the version)\n- Confirm the affected root CAs are removed from the system trust store after the update","reach":"network","title":"Red Hat CA store: weak eMudhra intermediates let attackers impersonate TLS sites","impact":"medium","summary":"The system certificate authority store shipped in Red Hat ca-certificates packages trusted root CAs that signed intermediate CAs with weak private keys issued by eMudhra. A man-in-the-middle attacker could use those intermediates to issue certificates for arbitrary host names that TLS clients using the system store would trust, sending clients to malicious sites.","category":"infrastructure","nicknames":[],"who_cares":["red-hat","rhel","linux","ca-certificates","tls"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker impersonates arbitrary TLS sites to clients via man-in-the-middle position","analyst_note":"Find Red Hat's advisory and the fixed ca-certificates package versions from the NVD reference; the sources give no version or affected release list.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-red-hat-systems","custom-trust-store"],"who_is_affected":"Systems on Red Hat products that use the system CA store through ca-certificates RPM packages are affected, since TLS clients on those systems trust the bundled roots. The sources do not say which Red Hat releases are impacted, and systems that do not rely on the system CA store for TLS trust are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3488,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114406':15A,18A '-2026':14A,17A 'arbitrari':71B,142C 'attack':9A,62B,133C 'author':32B,91C,111C,126C,195C 'ca':3A,20B,39B,92C,101C,108C,115C,150C,163C,189C,192C,200C 'ca-certif':19B,38B,100C 'cas':44B,48B 'caus':166C 'certif':21B,31B,40B,69B,90C,102C,109C,116C,125C,140C,151C,182C,193C,201C 'client':76B,84B,160C,168C,185C 'connect':170C 'consid':155C 'could':63B,134C 'cve':13A,16A 'distribut':98C 'distrust':179C 'due':174C 'emudhra':6A,55B,124C 'flaw':137C 'hat':2A,26B,37B,96C 'host':72B,143C 'imperson':10A 'inabl':176C 'includ':105C 'infrastructur':22B 'intermedi':7A,47B,66B,114C,149C,181C,199C 'issu':53B,68B,121C,139C 'key':52B,120C 'let':8A 'linux':23B 'malici':86B,172C 'man':58B,129C 'man-in-the-middl':57B,128C 'middl':61B,132C 'multipl':106C 'name':73B,144C 'packag':41B,104C 'privat':51B,119C 'product':97C 'red':1A,25B,36B,95C 'red-hat':24B 'remov':204C 'rhel':27B 'root':43B,107C,191C 'rpm':103C 'send':83B 'ship':34B 'sign':46B,113C,145C,197C 'site':12A,87B,173C 'specif':180C 'store':4A,33B,80B,93C,164C,190C 'system':30B,79B,89C,162C,188C 'tls':11A,28B,75B 'tls/ssl':159C 'trust':42B,82B,156C 'use':64B,77B,135C,161C,186C 'via':99C 'weak':5A,50B,118C,148C,198C 'would':81B,153C","nicknames":[],"mitigations":[],"who_affected":"Systems on Red Hat products that use the system CA store through ca-certificates RPM packages are affected, since TLS clients on those systems trust the bundled roots. The sources do not say which Red Hat releases are impacted, and systems that do not rely on the system CA store for TLS trust are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114406","severity":null,"published_at":"2026-10-21T21:17:58+00:00","modified_at":"2026-10-23T20:17:20+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114406","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114406","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}