CVE-2026-114406 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Red Hat-based systems, particularly those using the system CA store for TLS/SSL connections, should assess their exposure and take remediation steps.

Why it matters

A vulnerability in the system certificate authority (CA) store in Red Hat products could allow a man-in-the-middle attacker to issue trusted certificates, potentially leading to security risks for TLS/SSL connections. Defenders should prioritize verifying and updating their system CA stores, reviewing certificate trust settings, and ensuring secure certificate validation for clients.

• Potential for man-in-the-middle attacks due to weak intermediate CA certificates
• Need for verification and updates to the system CA store
• Potential impact on TLS/SSL connections using the system CA store
• Requirement for review of certificate trust settings

Technical summary

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. This flaw could allow a man-in-the-middle attacker to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using the system CA store.

Defensive priority

Defenders should prioritize verifying and updating their system CA stores, reviewing certificate trust settings, and ensuring that clients are configured to use secure certificate validation.

Recommended defensive actions

• Verify and update the system CA store on all Red Hat-based systems
• Review and adjust certificate trust settings for clients using the system CA store
• Ensure clients are configured to use secure certificate validation
• Monitor for and apply additional Red Hat errata related to this vulnerability
• Perform a thorough review of system configurations for potential exposure
• Implement additional monitoring to detect potential man-in-the-middle attacks
• Review and update asset inventories to ensure all affected systems are accounted for

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the system CA store. Red Hat has released multiple errata related to this issue, indicating affected products and providing remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.