CVE-2026-114406: Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Published Oct 20, 2026

Updated

Distrust intermediate CA certificates due to security concerns

Other sources

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.

Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

— MITRE

Affected Software

1 affected component

redhat/ca-certificates

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove eMudhra root CA certificates from your environment.
Remove the root CA certificates of authorities that signed weak eMudhra intermediate CA certificates from the system CA store.

Event History

Oct 20, 2026

Data Sourced

via Red Hat·09:04 AM

DescriptionSeverityAffected Software

Oct 21, 2026

CVE Published

via MITRE·08:56 PM

Data Sourced

via MITRE·08:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

TLS/SSL clients that use the Red Hat system CA store distributed through the ca-certificates RPM may trust certificates chained through the affected weak eMudhra intermediate certificates. Exposure is relevant when an attacker can position themselves to perform a man-in-the-middle attack.

What does an attacker need to exploit this?

An attacker must be able to conduct a man-in-the-middle attack and use a certificate for an arbitrary hostname signed by one of the weak intermediate CA certificates. User interaction is required according to the supplied severity vector.

What is the remediation approach?

The affected root CA certificates that signed the weak intermediate certificates are being removed from the system CA store. This broader removal is necessary because specific intermediate certificates cannot be distrusted across all clients using the system CA store.

CVE-2026-114406: Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit this?

What is the remediation approach?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit this?

What is the remediation approach?