Skip to content
fr Sign in
6.8 Medium

CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Description

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Assisted Installer for Red Hat OpenShift Container Platform 2 Versions not published
cert-manager Operator for Red Hat OpenShift Versions not published
Confidential Compute Attestation Versions not published
Kernel Module Management Operator for Red Hat Openshift Versions not published
Kube Descheduler Operator Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Logical Volume Manager Storage Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Containers Versions not published
Show the 71 other branches
Product Affected versions Fixed in
Migration Toolkit for Virtualization Versions not published
Multicluster Engine for Kubernetes Versions not published
Network Observability Operator Versions not published
OpenShift Serverless Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat OpenShift for Windows Containers Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat OpenShift Virtualization 5 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat OpenShift Builds 1.8.3 1792851895 earliest → < 1792851895 1792851895
Red Hat OpenShift Builds 1.9.2 1792835571 earliest → < 1792835571 1792835571
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Versions not published
Red Hat OpenShift Container Platform 4.12 412.86 earliest → < 412.86.202610250235-0 412.86.202610250235-0
Red Hat OpenShift Container Platform 4.14 414.92 earliest → < 414.92.202610242240-0 414.92.202610242240-0
Red Hat OpenShift Container Platform 4.16 416.94 earliest → < 416.94.202610242150-0 416.94.202610242150-0
Red Hat OpenShift Container Platform 4.18 418.94 earliest → < 418.94.202610242013-0 418.94.202610242013-0
Red Hat OpenShift Container Platform 4.22 4.22 earliest → < 4.22.9.8.202610241758-0 4.22.9.8.202610241758-0
Red Hat OpenShift Container Platform 4.19 4.19 earliest → < 4.19.9.6.202610241701-0 4.19.9.6.202610241701-0
Red Hat OpenShift Container Platform 4.20 4.20 earliest → < 4.20.9.6.202610242033-0 4.20.9.6.202610242033-0
Red Hat OpenShift Container Platform 4.21 4.21 earliest → < 4.21.9.6.202610241345-0 4.21.9.6.202610241345-0
agentic cluster security suite 0.2 1793102187 earliest → < 1793102187 1793102187
Red Hat Update Infrastructure 5 1793005812 earliest → < 1793005812 1793005812
Red Hat Advanced Cluster Security for Kubernetes 4.10 1793184257 earliest → < 1793184257 1793184257
Red Hat OpenShift AI 3.0 1793328358 earliest → < 1793328358 1793328358
Red Hat OpenShift AI 3.4 1793326837 earliest → < 1793326837 1793326837
Red Hat OpenShift AI 3.5 1793719302 earliest → < 1793719302 1793719302
Red Hat OpenShift Dev Spaces 3.31 1793120195 earliest → < 1793120195 1793120195
Red Hat OpenShift Container Platform 5 Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenStack Platform 13.0 - ELS Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 for RHEL 9 Versions not published
Red Hat OpenStack Services on OpenShift 18.0 Versions not published
Red Hat AI Inference Server 3.5 1793444600 earliest → < 1793444600 1793444600
Red Hat OpenShift GitOps 1.20 1793682096 earliest → < 1793682096 1793682096
Red Hat OpenShift GitOps 1.21 1793691455 earliest → < 1793691455 1793691455
Red Hat OpenShift GitOps 1.22 1793684655 earliest → < 1793684655 1793684655
Red Hat Discovery 2 1793733716 earliest → < 1793733716 1793733716
Red Hat OpenShift for Windows Containers 11.0 1793279001 earliest → < 1793279001 1793279001
Red Hat Advanced Cluster Security for Kubernetes 4.11 1793745312 earliest → < 1793745312 1793745312
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 1793184257 earliest → < 1793184257 1793184257
Service Interconnect 2 for RHEL 9 2.2 earliest → < 2.2.4-2 2.2.4-2
Red Hat Developer Hub 1 Versions not published
Red Hat Developer Hub 2 Versions not published
Cost Management 4 1793202662 earliest → < 1793202662 1793202662
Red Hat Cost Management On-Premise 1 1793825318 earliest → < 1793825318 1793825318

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Assisted Installer for Red Hat OpenShift Container Platform 2

The 27 CVEs of Assisted Installer for Red Hat OpenShift Container Platform 2 →
CVE-2026-96577 A flaw was found in oc-mirror 7.1 High CVE-2026-101295 Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction 7.3 High CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name… 6.5 Medium CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label 9.6 Critical
Track this CVE