Red Hat ca-certificates Weak Intermediate CA Trust Issue

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: redhat-SADP

Description

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-10-22

EPSS Evaluated

N/A

NVD

CVE-2026-114406

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 6 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat Hardened Images *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenShift Container Platform 4 *
Red	Hat	Red Hat OpenShift distributed tracing 3 *
Red	Hat	Red Hat OpenShift for Windows Containers *
Red	Hat	Red Hat OpenShift for Windows Containers *
Red	Hat	Red Hat OpenShift Virtualization 4 *
Red	Hat	Red Hat OpenShift Virtualization 5 *
Red	Hat	Red Hat Quay 3 *
Red	Hat	Red Hat Quay 3 *
Red	Hat	Assisted Installer for Red Hat OpenShift Container Platform 2 *
Red	Hat	cert-manager Operator for Red Hat OpenShift *
Red	Hat	Confidential Compute Attestation *
Red	Hat	Kernel Module Management Operator for Red Hat Openshift *
Red	Hat	Kube Descheduler Operator *
Red	Hat	Logging Subsystem for Red Hat OpenShift *
Red	Hat	Logical Volume Manager Storage *
Red	Hat	Logical Volume Manager Storage *
Red	Hat	Logical Volume Manager Storage *
Red	Hat	Migration Toolkit for Applications 8 *
Red	Hat	Migration Toolkit for Containers *
Red	Hat	Migration Toolkit for Virtualization *
Red	Hat	Multicluster Engine for Kubernetes *
Red	Hat	Network Observability Operator *
Red	Hat	OpenShift Serverless *
Red	Hat	OpenShift Serverless *
Red	Hat	OpenShift Service Mesh 3 *
Red	Hat	OpenShift Service Mesh 3 *
Red	Hat	OpenShift Service Mesh 3 *
Red	Hat	Red Hat Advanced Cluster Management for Kubernetes 2 *
Red	Hat	Red Hat Advanced Cluster Management for Kubernetes 2 *
Red	Hat	Red Hat Advanced Cluster Security 4 *
Red	Hat	Red Hat Advanced Cluster Security 4 *
Red	Hat	Red Hat Connectivity Link 1 *
Red	Hat	Red Hat Connectivity Link 1 *
Red	Hat	Red Hat Enterprise Linux 10 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-114406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70