CVE-2026-114406: Red Hat CA Certificate Information Leak

CVE-2026-114406 Overview

CVE-2026-114406 affects the system certificate authority (CA) store in Red Hat products, distributed via the ca-certificates RPM package. The store trusted multiple root CAs that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle (MITM) attacker able to compromise the weak intermediate keys could forge TLS/SSL certificates for arbitrary hostnames. Clients using the system CA store would accept those certificates as trusted, enabling redirection to malicious sites. Red Hat is removing the affected root CA certificates because clients using the system store cannot selectively distrust specific intermediates. This issue is tracked as CWE-295: Improper Certificate Validation.

Critical Impact
Attackers with access to the weak eMudhra intermediate keys can issue trusted certificates for any hostname, enabling TLS interception and credential theft against affected Red Hat systems.

Affected Products

Red Hat Enterprise Linux systems using the ca-certificates RPM package
Applications and services relying on the Red Hat system CA trust store for TLS/SSL validation
Any TLS client (browsers, curl, package managers, custom applications) that defers to the system trust bundle

Discovery Timeline

2026-10-21 - CVE-2026-114406 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114406

Vulnerability Analysis

The Red Hat ca-certificates package ships the operating system's default trust anchors. Several of these root CAs cross-signed or issued intermediate certificates to eMudhra that were generated with cryptographically weak private keys. Because X.509 trust is transitive, any certificate chain terminating at one of these roots is treated as valid by TLS clients that consume the system store. An adversary who recovers the private key of a weak intermediate can mint certificates for any domain and present them during a TLS handshake. The vulnerability is a trust-store governance failure rather than a software bug in a specific binary.

Root Cause

The root cause is improper certificate validation at the trust-anchor layer. The affected intermediate CAs were issued with insufficient key strength, which does not meet modern cryptographic requirements. Standard revocation mechanisms (CRL, OCSP) cannot be relied upon across every client. The system CA store lacks a granular distrust mechanism that applies uniformly to all consuming applications, so the only reliable remediation is removing the parent root CAs that chain to the weak intermediates.

Attack Vector

Exploitation requires network positioning for a MITM attack and user interaction, such as initiating a TLS connection to a target host. The attacker intercepts the TLS handshake and presents a forged leaf certificate signed by the compromised weak intermediate. Because the chain terminates at a root still trusted by the system store, the client accepts the connection. Confidentiality and integrity of transmitted data are both at risk, including credentials, session tokens, and software update payloads retrieved over HTTPS.

No verified public exploit code is available for this issue. Refer to the Red Hat CVE Details page and Red Hat Security Bulletin RHSB-2026-012 for authoritative technical details.

Detection Methods for CVE-2026-114406

Indicators of Compromise

Presence of eMudhra-chained intermediate CAs in the output of trust list or update-ca-trust inspection on Red Hat hosts.
Unexpected TLS certificates presented by internal or external services whose issuer chain includes an eMudhra intermediate.
Package inventories showing ca-certificates versions older than the fixed release referenced in RHSA-2026:86595.

Detection Strategies

Enumerate installed trust anchors with trust list --filter=ca-anchors and flag certificates referenced in Red Hat's distrust list.
Perform TLS scans of outbound and internal connections to log issuer and subject fields, then alert on chains that resolve through eMudhra intermediates.
Correlate ca-certificates package versions across the fleet using configuration management or endpoint telemetry to identify unpatched hosts.

Monitoring Recommendations

Continuously monitor TLS handshake metadata (JA3/JA4, issuer DN, SAN) at egress points for unexpected certificate issuers.
Alert on process execution of update-ca-trust, trust anchor, or direct writes to /etc/pki/ca-trust/source/anchors/ outside of patch windows.
Track DNS and network anomalies around sensitive endpoints (package mirrors, identity providers, internal APIs) that could indicate active MITM activity.

How to Mitigate CVE-2026-114406

Immediate Actions Required

Apply the updated ca-certificates RPM published in RHSA-2026:86595 on all affected Red Hat systems.
Run update-ca-trust extract after package installation so that consumers of the extracted bundle (/etc/pki/ca-trust/extracted/) pick up the distrust changes.
Audit application-specific trust stores (Java cacerts, Node.js NODE_EXTRA_CA_CERTS, Python certifi) that may ship independent copies of the affected roots.

Patch Information

Red Hat has published a fixed ca-certificates package through Red Hat Security Advisory RHSA-2026:86595. The update removes the root CA certificates that signed the weak eMudhra intermediates. Additional context is available in Red Hat Bugzilla #2556046 and Red Hat Security Bulletin RHSB-2026-012.

Workarounds

Manually distrust the affected root CAs by placing them in /etc/pki/ca-trust/source/blacklist/ and running update-ca-trust extract until the package update can be applied.
Enforce certificate pinning or an internal PKI for critical client-to-service connections to reduce reliance on the system trust store.
Restrict outbound TLS through an inspecting proxy that enforces an allow-list of acceptable issuers.

bash

# Distrust affected roots and refresh the extracted trust bundle
sudo cp affected-root.pem /etc/pki/ca-trust/source/blacklist/
sudo update-ca-trust extract
trust list --filter=ca-anchors | grep -i emudhra