CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
CVE-2026-114406 is a medium vulnerability (CVSS 6.8) in Red Hat Agentic Cluster Security Suite 0.2, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in ca-certificates 2026.2.92_v9.0.319-100.3.el10_2.
- Severity
- 6.8 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.31%EPSS, 24th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2026.2.92_v9.0.319-100.3.el10_2ca-certificates +74 more
Description
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Discussion
Affected products
- red hat agentic cluster security suite 0.2
- red hat cost management 4
- red hat advanced cluster security for kubernetes 4.11
- red hat advanced cluster security for kubernetes for ibm power, little endian 4.10
- red hat ai inference server
- red hat ai inference server 3.2
- red hat ai inference server 3.4
- red hat ai inference server 3.5
- red hat cost management on-premise 1
- red hat developer hub 1.10
- red hat developer hub 2
- red hat developer hub 2.1
Show 46 moreShow less
- red hat discovery 2
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 6 extended lifecycle support - extension
- red hat enterprise linux 7 extended lifecycle support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
- red hat enterprise linux ai (rhel ai) 3
- red hat enterprise linux ai 3.5
- red hat hardened images
- red hat openshift ai (rhoai)
- red hat openshift ai 3.0
- red hat openshift ai 3.4
- red hat openshift ai 3.5
- red hat openshift builds 1.8.3
- red hat openshift builds 1.9.2
- red hat openshift container platform 4.12
- red hat openshift container platform 4.13
- red hat openshift container platform 4.14
- red hat openshift container platform 4.16
- red hat openshift container platform 4.17
- red hat openshift container platform 4.18
- red hat openshift container platform 4.19
- red hat openshift container platform 4.20
- red hat openshift container platform 4.21
- red hat openshift container platform 4.22
- red hat openshift container platform 5
- red hat openshift dev spaces 3.31
- red hat openshift for windows containers 11.0
- red hat openshift gitops 1.20
- red hat openshift gitops 1.21
- red hat openshift gitops 1.22
- red hat openstack platform 13.0 - els
- red hat openstack platform 16.2
- red hat openstack platform 17.1 for rhel 9
- red hat openstack services on openshift 18.0
- red hat update infrastructure 5
- red hat service interconnect 2 for rhel 9
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ca-certificatesAlmaLinux:10 | before 2026.2.92_v9.0.319-100.3.el10_2 | 2026.2.92_v9.0.319-100.3.el10_2 |
ca-certificatesAlmaLinux:9 | before 2026.2.92_v9.0.319-90.3.el9_8 | 2026.2.92_v9.0.319-90.3.el9_8 |
ca-certificatesAlmaLinux:8 | before 2026.2.92_v9.0.319-81.3.el8_10 | 2026.2.92_v9.0.319-81.3.el8_10 |
ca-certificatesAlpaquita:23 | 20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesAlpaquita:25 | 20241121-r2 up to 20261020-r0 | 20261020-r0 |
ca-certificatesAlpaquita:stream | 20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:23 | 20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:25 | 20241121-r2 up to 20261020-r0 | 20261020-r0 |
ca-certificatesBellSoft Hardened Containers:stream | 20220614-r3 up to 20261020-r0 | 20261020-r0 |
ca-certificatesRed Hat:hummingbird:1 | before 0:2026.2.92_v9.0.319-1.hum1 | 0:2026.2.92_v9.0.319-1.hum1 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ca-certificates-bundleRed Hat:hummingbird:1 | before 0:2026.2.92_v9.0.319-1.hum1 | 0:2026.2.92_v9.0.319-1.hum1 |
ca-certificatesRed Hat:enterprise_linux:10.2 | before 0:2026.2.92_v9.0.319-100.3.el10_2 | 0:2026.2.92_v9.0.319-100.3.el10_2 |
ca-certificatesRed Hat:enterprise_linux:9::baseos | before 0:2026.2.92_v9.0.319-90.3.el9_8 | 0:2026.2.92_v9.0.319-90.3.el9_8 |
ca-certificatesRed Hat:enterprise_linux:8::baseos | before 0:2026.2.92_v9.0.319-81.3.el8_10 | 0:2026.2.92_v9.0.319-81.3.el8_10 |
ca-certificatesRed Hat:enterprise_linux_eus:10.0 | before 0:2026.2.92_v9.0.319-100.3.el10_0 | 0:2026.2.92_v9.0.319-100.3.el10_0 |
ca-certificatesRed Hat:rhel_e4s:9.2::baseos | before 0:2026.2.92_v9.0.319-90.3.el9_2 | 0:2026.2.92_v9.0.319-90.3.el9_2 |
ca-certificatesRed Hat:rhel_eus:9.6::baseos | before 0:2026.2.92_v9.0.319-90.3.el9_6 | 0:2026.2.92_v9.0.319-90.3.el9_6 |
ca-certificatesRed Hat:rhel_e4s:9.4::baseos | before 0:2026.2.92_v9.0.319-90.3.el9_4 | 0:2026.2.92_v9.0.319-90.3.el9_4 |
ca-certificatesRed Hat:rhel_e4s:8.8::baseos | before 0:2026.2.92_v9.0.319-80.3.el8_8 | 0:2026.2.92_v9.0.319-80.3.el8_8 |
ca-certificatesRed Hat:rhel_tus:8.8::baseos | before 0:2026.2.92_v9.0.319-80.3.el8_8 | 0:2026.2.92_v9.0.319-80.3.el8_8 |
ca-certificatesRed Hat:rhel_aus:8.6::baseos | before 0:2026.2.92_v9.0.319-80.3.el8_6 | 0:2026.2.92_v9.0.319-80.3.el8_6 |
ca-certificatesRed Hat:rhel_eus_long_life:8.6::baseos | before 0:2026.2.92_v9.0.319-80.3.el8_6 | 0:2026.2.92_v9.0.319-80.3.el8_6 |
ca-certificatesRed Hat:rhel_aus:8.4::baseos | before 0:2026.2.92_v9.0.319-80.3.el8_4 | 0:2026.2.92_v9.0.319-80.3.el8_4 |
ca-certificatesRed Hat:rhel_els:7 | before 0:2026.2.92_v9.0.319-70.3.el7_9 | 0:2026.2.92_v9.0.319-70.3.el7_9 |
ca-certificatesRed Hat:rhel_els:6 | before 0:2026.2.92_v9.0.319-60.3.el6_10 | 0:2026.2.92_v9.0.319-60.3.el6_10 |
nssRed Hat:rhel_els:6 | before 0:3.44.0-15.el6_10 | 0:3.44.0-15.el6_10 |
nss-develRed Hat:rhel_els:6 | before 0:3.44.0-15.el6_10 | 0:3.44.0-15.el6_10 |
nss-sysinitRed Hat:rhel_els:6 | before 0:3.44.0-15.el6_10 | 0:3.44.0-15.el6_10 |
nss-toolsRed Hat:rhel_els:6 | before 0:3.44.0-15.el6_10 | 0:3.44.0-15.el6_10 |
nss-pkcs11-develRed Hat:rhel_els:6 | before 0:3.44.0-15.el6_10 | 0:3.44.0-15.el6_10 |
python-botocoreRed Hat:openstack:13::el7 | before 0:1.8.33-2.el7ost | 0:1.8.33-2.el7ost |
python2-botocoreRed Hat:openstack:13::el7 | before 0:1.8.33-2.el7ost | 0:1.8.33-2.el7ost |
python-botocoreRed Hat:openstack:16.2::el8 | before 0:1.12.119-4.el8ost | 0:1.12.119-4.el8ost |
python3-botocoreRed Hat:openstack:16.2::el8 | before 0:1.12.119-4.el8ost | 0:1.12.119-4.el8ost |
python-botocoreRed Hat:openstack:17.1::el9 | before 0:1.20.68-2.el9ost | 0:1.20.68-2.el9ost |
python3-botocoreRed Hat:openstack:17.1::el9 | before 0:1.20.68-2.el9ost | 0:1.20.68-2.el9ost |
python-botocoreRed Hat:openstack:18.0::el9 | before 0:1.27.89-3.el9ost | 0:1.27.89-3.el9ost |
python3-botocoreRed Hat:openstack:18.0::el9 | before 0:1.27.89-3.el9ost | 0:1.27.89-3.el9ost |
ca-certificatesRocky Linux:10 | before 0:2026.2.92_v9.0.319-100.3.el10_2 | 0:2026.2.92_v9.0.319-100.3.el10_2 |
ca-certificatesRocky Linux:9 | before 0:2026.2.92_v9.0.319-90.3.el9_8 | 0:2026.2.92_v9.0.319-90.3.el9_8 |
ca-certificatesRocky Linux:8 | before 0:2026.2.92_v9.0.319-81.3.el8_10 | 0:2026.2.92_v9.0.319-81.3.el8_10 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 16.0 | before 2.92-160000.1.1 | 2.92-160000.1.1 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 16.0 | before 2.92-160000.1.4 | 2.92-160000.1.4 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP applications 16.0 | before 2.92-160000.1.1 | 2.92-160000.1.1 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP applications 16.0 | before 2.92-160000.1.4 | 2.92-160000.1.4 |
ca-certificates-mozillaSUSE:Linux Micro 6.0 | before 2.92-159998.1.1 | 2.92-159998.1.1 |
ca-certificates-mozillaSUSE:Linux Micro 6.1 | before 2.92-slfo.1.1_1.1 | 2.92-slfo.1.1_1.1 |
ca-certificates-mozillaSUSE:Linux Micro 6.2 | before 2.92-160000.1.1 | 2.92-160000.1.1 |
openssl-certsSUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | before 2.92-0.7.39.1 | 2.92-0.7.39.1 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.3 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.4 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Micro 5.5 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozillaSUSE:Linux Enterprise Module for Basesystem 15 SP7 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Module for Development Tools 15 SP7 | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP4-LTSS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP4-LTSS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP5-LTSS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP5-LTSS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server 15 SP6-LTSS | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server 15 SP6-LTSS | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP4 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP4 | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP5 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP5 | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaSUSE:Linux Enterprise Server for SAP Applications 15 SP6 | before 2.92-150200.50.2 | 2.92-150200.50.2 |
ca-certificates-mozilla-prebuiltSUSE:Linux Enterprise Server for SAP Applications 15 SP6 | before 2.92-150200.50.3 | 2.92-150200.50.3 |
ca-certificates-mozillaopenSUSE:Tumbleweed | before 2.92-2.1 | 2.92-2.1 |
What each source reports
CVE List Score used
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-13
EUVDEUVD-2026-107565
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
EUVD-2026-107565- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-jrx5-4fv3-4mcq
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates...
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
GHSA-jrx5-4fv3-4mcq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-13
NVD
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
- Record
CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-13
OSVBELL-CVE-2026-114406
- Record
BELL-CVE-2026-114406- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:86595
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:86595- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
Show 29 moreShow less
OSVRHSA-2026:88455
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88455- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88459
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88459- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88550
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88550- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88560
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88560- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88562
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88562- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88563
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88563- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88564
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88564- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88662
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88662- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88668
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88668- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88669
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88669- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:88779
Red Hat Security Advisory: ca-certificates security update
- Record
RHSA-2026:88779- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:90985
Red Hat Security Advisory: ca-certificates and nss security update
- Record
RHSA-2026:90985- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:93043
Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (python-botocore) security update
- Record
RHSA-2026:93043- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:93044
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-botocore) security update
- Record
RHSA-2026:93044- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:93045
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-botocore) security update
- Record
RHSA-2026:93045- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRHSA-2026:93046
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-botocore) security update
- Record
RHSA-2026:93046- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
OSVRLSA-2026:88455
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88455- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2026:88459
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88459- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2026:88550
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:88550- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVALSA-2026:88455No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88455- Updated
- 2026-11-02
OSVALSA-2026:88459No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88459- Updated
- 2026-11-02
OSVALSA-2026:88550No score
Critical: ca-certificates security update
The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix(es):
- ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:88550- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12233-1No score
ca-certificates-mozilla-2.92-2.1 on GA media
These are all security issues fixed in the ca-certificates-mozilla-2.92-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12233-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24361-1No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24361-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24373-1No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24373-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24383-1No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issues:
Updated to 2.92 state (bsc#1286261 bsc#1287180 CVE-2026-114406) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
Updated to 2.90 state (bsc#1279961) Removed:
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- certSIGN ROOT CA
- Entrust Root Certification Authority
- PKI Root Certification Authority
- FIRMAPROFESIONAL CA ROOT-A WEB
- GLOBALTRUST 2020
- Secure Global CA
- SecureSign Root CA12
- SecureTrust CA
- TeliaSonera Root CA v1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- XRamp Global Certification Authority
Added:
- SECOM SMIME RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- SECOM TLS RSA Root CA 2024
- SecureSign Root CA16
- Telia EC Email Root CA v3
- Telia EC TLS Root CA v3
- Telia RSA Email Root CA v3
- Telia RSA TLS Root CA v3
- Record
SUSE-SU-2026:24383-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24414-1No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:24414-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4820-1No score
Security update for openssl-certs
This update for openssl-certs fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:4820-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4847-1No score
Security update for ca-certificates-mozilla
This update for ca-certificates-mozilla fixes the following issue:
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180) Removed:
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
- Record
SUSE-SU-2026:4847-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, GitHub Advisories, NVD, OSV | |
| products, references | CVE List, EUVD | |
| products, references | CVE List, EUVD, NVD | |
| products, references | CVE List | |
| references | EUVD, GitHub Advisories | |
| products, references | CVE List | |
| products, references | CVE List, GitHub Advisories, NVD | |
| products, references | EUVD, GitHub Advisories, NVD | |
| products, references | CVE List, GitHub Advisories, NVD | |
| products | EUVD |
Show 4 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| products, references | CVE List, EUVD, GitHub Advisories, NVD | |
| facts, products, references | CVE List, EUVD, GitHub Advisories, NVD | |
| references | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2026:86595
Show 128 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2556046
nvd.nist.gov/vuln/detail/CVE-2026-114406
github.com/advisories/GHSA-jrx5-4fv3-4mcq
errata.almalinux.org/10/ALSA-2026-88455.html
docs.bell-sw.com/security/cves/CVE-2026-114406
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86595.json
cve.org/CVERecord?id=CVE-2026-114406
errata.rockylinux.org/RLSA-2026:88455
suse.com/support/update/announcement/2026/suse-su-202624361-1
bugzilla.suse.com/1286261