Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114406— Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Quick assessment

Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

通过 RPM 包分发的 Red Hat 产品系统证书颁发机构（CA）存储中，包含了多个根 CA 证书，这些根 CA 曾为 eMudhra 证书颁发机构签发的、使用弱私钥的中间 CA 证书进行签名。中间人攻击者可利用此漏洞，使用这些弱中间 CA 证书为任意主机名签发证书；由于这些证书会被使用系统 CA 存储的 TLS/SSL 客户端视为可信，从而诱导客户端连接到恶意网站。 由于无法在所有使用系统 CA 存储的客户端中仅对特定中间证书实施不信任策略，因此正在移除那些曾为弱中间 CA 证书签名的根 CA 证书。

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114406

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
Source: CVE Program / CVE List V5
Vulnerability Description
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Hardened Images 2026.2.92_v9.0.319-1.hum1 ~ * cpe:/a:redhat:hummingbird:1
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 - cpe:/a:redhat:assisted_installer:2
Red Hat cert-manager Operator for Red Hat OpenShift - cpe:/a:redhat:cert_manager:1
Red Hat Confidential Compute Attestation - cpe:/a:redhat:confidential_compute_attestation:1
Red Hat Kernel Module Management Operator for Red Hat Openshift - cpe:/a:redhat:kernel_module_management:2
Red Hat Kube Descheduler Operator - cpe:/a:redhat:kube_descheduler_operator:5
Red Hat Logging Subsystem for Red Hat OpenShift - cpe:/a:redhat:logging:6
Red Hat Logical Volume Manager Storage - cpe:/a:redhat:lvms:4
Red Hat Logical Volume Manager Storage - cpe:/a:redhat:lvms:4
Red Hat Logical Volume Manager Storage - cpe:/a:redhat:lvms:5
Red Hat Migration Toolkit for Applications 8 - cpe:/a:redhat:migration_toolkit_applications:8
Red Hat Migration Toolkit for Containers - cpe:/a:redhat:rhmt:1
Red Hat Migration Toolkit for Virtualization - cpe:/a:redhat:migration_toolkit_virtualization:2
Red Hat Multicluster Engine for Kubernetes - cpe:/a:redhat:multicluster_engine
Red Hat Network Observability Operator - cpe:/a:redhat:network_observ_optr:1
Red Hat OpenShift Serverless - cpe:/a:redhat:serverless:1
Red Hat OpenShift Serverless - cpe:/a:redhat:serverless:1
Red Hat OpenShift Service Mesh 3 - cpe:/a:redhat:service_mesh:3
Red Hat OpenShift Service Mesh 3 - cpe:/a:redhat:service_mesh:3
Red Hat OpenShift Service Mesh 3 - cpe:/a:redhat:service_mesh:3
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 - cpe:/a:redhat:acm:2
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 - cpe:/a:redhat:acm:2
Red Hat Red Hat Advanced Cluster Security 4 - cpe:/a:redhat:advanced_cluster_security:4
Red Hat Red Hat Advanced Cluster Security 4 - cpe:/a:redhat:advanced_cluster_security:4
Red Hat Red Hat Connectivity Link 1 - cpe:/a:redhat:connectivity_link:1
Red Hat Red Hat Connectivity Link 1 - cpe:/a:redhat:connectivity_link:1
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8

II. Public POCs for CVE-2026-114406

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114406

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-114406 (3)

Other References for CVE-2026-114406 (1)

Same Patch Batch · Red Hat · 2026-10-21 · 11 CVEs total

CVE-2026-110744 7.2 HIGH Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impe
CVE-2026-17557 6.5 MEDIUM Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer cred
CVE-2026-92824 6.2 MEDIUM Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
CVE-2026-92822 6.2 MEDIUM Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-92823 6.2 MEDIUM Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
CVE-2026-85518 6.1 MEDIUM Openscap: openscap: arbitrary file write via path traversal in source datastream decomposi
CVE-2026-114038 5.1 MEDIUM Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed for
CVE-2026-114438 4.2 MEDIUM Keycloak-services: keycloak-services: required otp enrollment bypassed via update user loc
CVE-2026-114370 3.7 LOW Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink t
CVE-2026-114236 3.3 LOW Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompre

IV. Related Vulnerabilities

Same product: Red Hat Hardened Images
Same vendor: Red Hat
Same weakness: CWE-295

V. Comments for CVE-2026-114406

No comments yet

Leave a comment