Vulnpedia
← Search CVEs

CVE-2026-114406

MEDIUM 6.8

Published 2026-10-21 · Last modified 2026-10-25

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 24th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.8CVSS 3.1 · MEDIUM

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: A user must take an action (click / open a file)
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Red Hat

Products Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long Life Add On Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 8.8 Update Services For Sap Solutions Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 9.2 Update Services For Sap Solutions Red Hat Enterprise Linux 9.4 Update Services For Sap Solutions

Weakness (CWE)

  • CWE-295: Improper Certificate Validation

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 120 vendor product statements; 88 omitted. Read the full vendor advisory.

  • ca-certificates-0:2026.2.92_v9.0.319-70.3.el7_9.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-70.3.el7_9?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates-0:2026.2.92_v9.0.319-81.3.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-81.3.el8_10?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates-0:2026.2.92_v9.0.319-80.3.el8_6.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-80.3.el8_6?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates-0:2026.2.92_v9.0.319-90.3.el9_4.noarch as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-90.3.el9_4?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates-0:2026.2.92_v9.0.319-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates-bundle-0:2026.2.92_v9.0.319-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_v9.0.319-1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9@sha256:e96a41f4107151a83e1dc88e966fc943bd6ba49146cfabdac3ad2ea007eef40f_ppc64le as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-git-cloner-rhel9@sha256%3Ae96a41f4107151a83e1dc88e966fc943bd6ba49146cfabdac3ad2ea007eef40f?arch=ppc64le&repository_url=registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9&tag=1792835365

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9@sha256:bca22525d49539ef38909986bb145da1633057e24da2cf24ebdee5cdcb832a80_amd64 as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-image-processing-rhel9@sha256%3Abca22525d49539ef38909986bb145da1633057e24da2cf24ebdee5cdcb832a80?arch=amd64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel9&tag=1792836805

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator@sha256:9f5670a6166e7ba2c21f57a66760715d3c860ebd7cffab281873a8630dc3289a_s390x as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-rhel9-operator@sha256%3A9f5670a6166e7ba2c21f57a66760715d3c860ebd7cffab281873a8630dc3289a?arch=s390x&repository_url=registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator&tag=1792844269

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9@sha256:6c0a1a8e7c4ab37388ac9e3e67a737058f232350f5821638f7cadefbd71c32f0_s390x as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-shared-resource-webhook-rhel9@sha256%3A6c0a1a8e7c4ab37388ac9e3e67a737058f232350f5821638f7cadefbd71c32f0?arch=s390x&repository_url=registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9&tag=1792838794

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-webhook-rhel9@sha256:4b71588e2f2c11e1682ef625b23e95c198cebb95023222fe8ea5822b6914c5fd_arm64 as a component of Red Hat OpenShift Builds 1.8.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-webhook-rhel9@sha256%3A4b71588e2f2c11e1682ef625b23e95c198cebb95023222fe8ea5822b6914c5fd?arch=arm64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-webhook-rhel9&tag=1792851895

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.8.z upgrade to 1.8.3 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10@sha256:f0c1290d70b77a3b7bc83b183abb870438b564bcb4f0597a215d2487d691f4c9_s390x as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-controller-rhel10@sha256%3Af0c1290d70b77a3b7bc83b183abb870438b564bcb4f0597a215d2487d691f4c9?arch=s390x&repository_url=registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10&tag=1792837598

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10@sha256:0b7b0906619eabc1ac3a161e5762ec11684086ec9a7915bda1a8dfc6863ad9f9_amd64 as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-image-bundler-rhel10@sha256%3A0b7b0906619eabc1ac3a161e5762ec11684086ec9a7915bda1a8dfc6863ad9f9?arch=amd64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10&tag=1792838765

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10@sha256:b1f95359097339473ba91792f031783566dd0da7b4e9967dd4f518cef0599913_arm64 as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-image-processing-rhel10@sha256%3Ab1f95359097339473ba91792f031783566dd0da7b4e9967dd4f518cef0599913?arch=arm64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-image-processing-rhel10&tag=1792835879

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10@sha256:c850f527fec1a7216018e8fdabe6b9d9e9964d61a713f15c828dd8d1f89a3d7a_s390x as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-shared-resource-rhel10@sha256%3Ac850f527fec1a7216018e8fdabe6b9d9e9964d61a713f15c828dd8d1f89a3d7a?arch=s390x&repository_url=registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel10&tag=1792857112

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel10@sha256:6f0d07bf9d18d5569a167140c5d72557e8bd11ee6419f4449dad24a9c084abbe_arm64 as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-waiters-rhel10@sha256%3A6f0d07bf9d18d5569a167140c5d72557e8bd11ee6419f4449dad24a9c084abbe?arch=arm64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel10&tag=1792839475

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-webhook-rhel10@sha256:a35fa5ec5c67023feddf3416f80f5517f975012f48572beb91d6e1f155c40cd7_amd64 as a component of Red Hat OpenShift Builds 1.9.2 · fixed

    Vendor assessment for this product only.

    pkg:oci/openshift-builds-webhook-rhel10@sha256%3Aa35fa5ec5c67023feddf3416f80f5517f975012f48572beb91d6e1f155c40cd7?arch=amd64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-webhook-rhel10&tag=1792835571

    • vendor fix: It is recommended that existing users of Red Hat OpenShift Builds 1.9.z upgrade to 1.9.2 Vendor guidance
    • workaround: See the security bulletin for a detailed mitigation procedure.
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • advanced-cluster-security/rhacs-central-db-rhel8 as a component of Red Hat Advanced Cluster Security 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/rhacs-central-db-rhel8?repository_url=registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ca-certificates

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • ca-certificates.src as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ca-certificates?arch=src

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/argo-rollouts-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argo-rollouts-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/argocd-agent-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-agent-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/argocd-image-updater-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-image-updater-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/argocd-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/argocd-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/argocd-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/dex-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/dex-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/dex-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/gitops-promoter-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-promoter-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/gitops-promoter-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/gitops-rhel9 as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • openshift-gitops-1/gitops-rhel9-operator as a component of Red Hat OpenShift GitOps · known affected

    Vendor assessment for this product only.

    pkg:oci/gitops-rhel9-operator?repository_url=registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator

    • workaround: See the security bulletin for a detailed mitigation procedure.
    • none available: Affected
    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:7c8e411b9c54a00dad3798858a6ab3f35322539c6601a068fe9c0f7ab1911852_amd64 as a component of Red Hat OpenShift Builds 1.8.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/openshift-builds-operator-bundle@sha256%3A7c8e411b9c54a00dad3798858a6ab3f35322539c6601a068fe9c0f7ab1911852?arch=amd64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-operator-bundle&tag=1792853955

    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00
  • registry.redhat.io/openshift-builds/openshift-builds-operator-bundle@sha256:029d766c4d9f339659da8b20644df820cf3e4ee61cc618adf3735138945c77ec_amd64 as a component of Red Hat OpenShift Builds 1.9.2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/openshift-builds-operator-bundle@sha256%3A029d766c4d9f339659da8b20644df820cf3e4ee61cc618adf3735138945c77ec?arch=amd64&repository_url=registry.redhat.io/openshift-builds/openshift-builds-operator-bundle&tag=1792863311

    Red Hat · CVE-2026-114406 · Updated 2026-10-26T11:02:58+00:00

All CVSS metrics

  • MEDIUM 6.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
  • MEDIUM 6.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS