CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-05
EUVDEUVD-2026-107565
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
EUVD-2026-107565- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-jrx5-4fv3-4mcq
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates...
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
GHSA-jrx5-4fv3-4mcq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-05
NVD
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-05
OSVBELL-CVE-2026-114406
- Record
BELL-CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2026:88455
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88455- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSVRLSA-2026:88459
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88459- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2026:88550
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88550- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVALSA-2026:88455 No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88455- Updated
- 2026-11-02
OSVALSA-2026:88459 No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88459- Updated
- 2026-11-02
OSVALSA-2026:88550 No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88550- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12233-1 No score
ca-certificates-mozilla-2.92-2.1 on GA media
These are all security issues fixed in the ca-certificates-mozilla-2.92-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12233-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24361-1 No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24361-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24373-1 No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24373-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24383-1 No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issues:
Updated to 2.92 state (bsc#1286261 bsc#1287180 CVE-2026-114406) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
Updated to 2.90 state (bsc#1279961) Removed:
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- certSIGN ROOT CA
- Entrust Root Certification Authority
- PKI Root Certification Authority
- FIRMAPROFESIONAL CA ROOT-A WEB
- GLOBALTRUST 2020
- Secure Global CA
- SecureSign Root CA12
- SecureTrust CA
- TeliaSonera Root CA v1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- XRamp Global Certification Authority
Added:
- SECOM SMIME RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- SECOM TLS RSA Root CA 2024
- SecureSign Root CA16
- Telia EC Email Root CA v3
- Telia EC TLS Root CA v3
- Telia RSA Email Root CA v3
- Telia RSA TLS Root CA v3
- Record
SUSE-SU-2026:24383-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24414-1 No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24414-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4820-1 No score
Security update for openssl-certs
This update for openssl-certs fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:4820-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4847-1 No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:4847-1- Updated
- 2026-11-02
Affected products
- red hat agentic cluster security suite 0.2
- red hat cost management 4
- red hat advanced cluster security for kubernetes 4.11
- red hat advanced cluster security for kubernetes for ibm power, little endian 4.10
- red hat ai inference server
- red hat ai inference server 3.5
- red hat cost management on-premise 1
- red hat developer hub 1
- red hat developer hub 2
- red hat discovery 2
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
Show 40 moreShow less
- red hat enterprise linux 6 extended lifecycle support - extension
- red hat enterprise linux 7 extended lifecycle support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
- red hat enterprise linux ai (rhel ai) 3
- red hat hardened images
- red hat openshift ai (rhoai)
- red hat openshift ai 3.0
- red hat openshift ai 3.4
- red hat openshift ai 3.5
- red hat openshift builds 1.8.3
- red hat openshift builds 1.9.2
- red hat openshift container platform 4.12
- red hat openshift container platform 4.14
- red hat openshift container platform 4.16
- red hat openshift container platform 4.18
- red hat openshift container platform 4.19
- red hat openshift container platform 4.20
- red hat openshift container platform 4.21
- red hat openshift container platform 4.22
- red hat openshift container platform 5
- red hat openshift dev spaces 3.31
- red hat openshift for windows containers 11.0
- red hat openshift gitops 1.20
- red hat openshift gitops 1.21
- red hat openshift gitops 1.22
- red hat openstack platform 13.0 - els
- red hat openstack platform 16.2
- red hat openstack platform 17.1 for rhel 9
- red hat openstack services on openshift 18.0
- red hat update infrastructure 5
- red hat service interconnect 2 for rhel 9
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ca-certificatesAlmaLinux:10 |
before 2026.2.92_v9.0.319-100.3.el10_2 | 2026.2.92_v9.0.319-100.3.el10_2 |
ca-certificatesAlmaLinux:9 |
before 2026.2.92_v9.0.319-90.3.el9_8 | 2026.2.92_v9.0.319-90.3.el9_8 |
ca-certificatesAlmaLinux:8 |
before 2026.2.92_v9.0.319-81.3.el8_10 | 2026.2.92_v9.0.319-81.3.el8_10 |
ca-certificatesAlpaquita:23 |
20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesAlpaquita:25 |
20241121-r2 up to 20261020-r0 | 20261020-r0 |
ca-certificatesAlpaquita:stream |
20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:23 |
20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:25 |
20241121-r2 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:stream |
20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesRocky Linux:10 |
before 0:2026.2.92_v9.0.319-100.3.el10_2 | 0:2026.2.92_v9.0.319-100.3.el10_2 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ca-certificatesRocky Linux:9 |
before 0:2026.2.92_v9.0.319-90.3.el9_8 | 0:2026.2.92_v9.0.319-90.3.el9_8 |
ca-certificatesRocky Linux:8 |
before 0:2026.2.92_v9.0.319-81.3.el8_10 | 0:2026.2.92_v9.0.319-81.3.el8_10 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 16.0 |
before 2.92-160000.1.1 | 2.92-160000.1.1 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 16.0 |
before 2.92-160000.1.4 | 2.92-160000.1.4 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 2.92-160000.1.1 | 2.92-160000.1.1 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 2.92-160000.1.4 | 2.92-160000.1.4 |
ca-certificates-mozillaSUSE:Linux Micro 6.0 |
before 2.92-159998.1.1 | 2.92-159998.1.1 |
ca-certificates-mozillaSUSE:Linux Micro 6.1 |
before 2.92-slfo.1.1_1.1 | 2.92-slfo.1.1_1.1 |
ca-certificates-mozillaSUSE:Linux Micro 6.2 |
before 2.92-160000.1.1 | 2.92-160000.1.1 |
openssl-certsSUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE |
before 2.92-0.7.39.1 | 2.92-0.7.39.1 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.3 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.4 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.5 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Module for Development Tools 15 SP7 |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaopenSUSE:Tumbleweed |
before 2.92-2.1 | 2.92-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| products, references | CVE List, GitHub Advisories, NVD | |
| products, references | EUVD, GitHub Advisories, NVD | |
| products, references | CVE List, GitHub Advisories, NVD | |
| products | EUVD | |
| products, references | CVE List, EUVD, GitHub Advisories, NVD | |
| facts, products, references | CVE List, EUVD, GitHub Advisories, NVD | |
| references | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114406 is a medium vulnerability (CVSS 6.8) in Red Hat Agentic Cluster Security Suite 0.2, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in ca-certificates 2026.2.92_v9.0.319-100.3.el10_2.
References
access.redhat.com/errata/RHSA-2026:86595
Show 92 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2556046
nvd.nist.gov/vuln/detail/CVE-2026-114406
github.com/advisories/GHSA-jrx5-4fv3-4mcq
errata.almalinux.org/10/ALSA-2026-88455.html
docs.bell-sw.com/security/cves/CVE-2026-114406
errata.rockylinux.org/RLSA-2026:88455
suse.com/support/update/announcement/2026/suse-su-202624361-1
bugzilla.suse.com/1286261