---
id: "CVE-2026-114406"
kind: "vulnerability"
aliases: ["CVE-2026-114406"]
title: "Red Hat CA store: weak eMudhra intermediates let attackers impersonate TLS sites"
severity: "medium"
cvss: 6.8
epss: 0.00273
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ca-certificates", "infrastructure", "linux", "red-hat", "rhel", "tls"]
not_affected_if: ["custom-trust-store", "non-red-hat-systems"]
published_at: "2026-10-21T21:17:58+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:42:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114406", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Red Hat CA store: weak eMudhra intermediates let attackers impersonate TLS sites

The system certificate authority store shipped in Red Hat ca-certificates packages trusted root CAs that signed intermediate CAs with weak private keys issued by eMudhra. A man-in-the-middle attacker could use those intermediates to issue certificates for arbitrary host names that TLS clients using the system store would trust, sending clients to malicious sites.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the ca-certificates RPM packages to the fixed build Red Hat publishes for CVE-2026-114406 (the sources do not name the version)
- Confirm the affected root CAs are removed from the system trust store after the update

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114406
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114406

## From the sources

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.

Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_