CVE-2026-114406

24th percentile - higher than 24% of all known CVEs

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could exploit this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by TLS/SSL clients using the system CA store. Due to the inability to distrust only specific intermediate certificates in all clients, root CA certificates of authorities that signed weak intermediate certificates are being removed.

A man-in-the-middle attacker could issue fake certificates for arbitrary hosts and impersonate trusted sites, potentially leading to interception of credentials or traffic.

Update the ca-certificates package to a version that removes the affected root CA certificates. Verify that applications do not rely on the removed certificate authorities.