CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
Description
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NExploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Versions not published | |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| Confidential Compute Attestation | Versions not published | |
| Kernel Module Management Operator for Red Hat Openshift | Versions not published | |
| Kube Descheduler Operator | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Logical Volume Manager Storage | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published |