CVE-2026-114406: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-114406 is an improper certificate validation vulnerability (CWE-295) affecting the system CA store distributed via ca-certificates RPM packages in Red Hat products. The CA store included root CA certificates that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority, enabling man-in-the-middle (MitM) attacks against TLS/SSL clients. Affected products span Red Hat Enterprise Linux 6–10, OpenShift Container Platform, OpenStack Platform, and numerous container images. The vulnerability was publicly disclosed on October 21, 2026, with a CVSS v3.1 base score of 6.8 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is that the Red Hat ca-certificates package (derived from the Mozilla NSS certificate store) included root CA certificates — specifically emSign Root CA - C1, emSign ECC Root CA - C3, and emSign ECC Root CA - G3 — that had signed eMudhra intermediate CA certificates whose private keys were weak or compromised (CWE-295: Improper Certificate Validation). Because TLS/SSL clients using the system CA store inherently trust any certificate chaining to a trusted root, an attacker in possession of the compromised intermediate CA private keys could forge certificates for arbitrary hostnames. The attack requires a network-level MitM position and user interaction (e.g., a user initiating a TLS connection), making exploitation moderately complex. Because selectively distrusting specific intermediate certificates is not universally supported across all clients using the system CA store, Red Hat's remediation removes the signing root CA certificates entirely (Red Hat CVE, Red Hat Security Bulletin, Red Hat Bugzilla).

A successful MitM attack exploiting this vulnerability allows an attacker to present fraudulently signed TLS certificates for any domain that are accepted as trusted by affected systems, enabling interception and modification of encrypted communications (high confidentiality and integrity impact, no availability impact). Any Red Hat Enterprise Linux system or derivative product using TLS — including HTTPS, internal service communication, or certificate-validated connections — is at risk. Container images based on RHEL or UBI that have not been rebuilt with the updated CA store are also affected, broadening the attack surface to cloud-native and containerized workloads (Red Hat Security Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess the compromised eMudhra intermediate CA private keys and be in a network MitM position, which significantly raises the bar for opportunistic attacks. No threat actor attribution has been reported (Red Hat Security Bulletin).

1. Obtain compromised private keys: Acquire the private keys of the eMudhra intermediate CA certificates (which were determined to be weak or compromised).
2. Issue fraudulent certificates: Use the compromised intermediate CA private keys to sign TLS certificates for arbitrary target hostnames (e.g., bank.example.com). These certificates will chain to root CAs trusted by the Red Hat system CA store.
3. Establish MitM position: Position the attack infrastructure to intercept network traffic between the target client and the legitimate server (e.g., via ARP spoofing, DNS hijacking, BGP hijacking, or rogue Wi-Fi access point).
4. Present fraudulent certificate: Serve the forged TLS certificate to the victim client during the TLS handshake. Clients using the unpatched Red Hat system CA store will accept the certificate as valid.
5. Intercept or modify traffic: Decrypt, inspect, or modify the encrypted communications between the victim and the intended destination, enabling credential theft, session hijacking, or data manipulation (Red Hat Security Bulletin, Red Hat CVE).

• Network: Unexpected TLS certificates presented during connections to known-good hosts that chain to emSign Root CA - C1, emSign ECC Root CA - C3, or emSign ECC Root CA - G3; TLS handshakes where the certificate issuer is an eMudhra intermediate CA for non-eMudhra-affiliated domains.
• Logs: TLS connection logs showing certificate chains rooted in the affected emSign root CAs for unexpected domains; certificate transparency log entries for suspicious certificates issued by eMudhra intermediates.
• File System: Presence of an unpatched ca-certificates RPM (check with rpm -q ca-certificates) that still includes the distrusted root certificates; absence of the updated package version 2026.2.92_v9.0.319-1.hum1 or later for ca-certificates-main.
• Process/Configuration: Systems where update-ca-trust has not been re-run after applying the updated ca-certificates package, leaving stale trust anchors in /etc/pki/ca-trust/ (Red Hat Security Bulletin, Red Hat Bugzilla).

Red Hat has released an updated ca-certificates package (version 2026.2.92_v9.0.319-1.hum1 or later for ca-certificates-main) that removes the affected root CA certificates. All affected RHEL systems (versions 6–10) and derivative products should update the ca-certificates package immediately using dnf update ca-certificates or yum update ca-certificates. As an interim workaround, administrators can manually blocklist the Comodo AAA Services and emSign ECC Root CA - G3 root certificates using the system trust mechanism (detailed steps are available in the Red Hat Knowledge Base). Container images based on RHEL/UBI should be rebuilt after the base image is updated. Verify the installed version with rpm -q ca-certificates (Red Hat Security Bulletin, Red Hat CVE).

Red Hat credited Mozilla for their rapid response and public disclosure regarding the eMudhra intermediate certificate compromise, and published Security Bulletin RHSB-2026-012 to coordinate remediation. Mozilla's NSS version 3.131.1 was released to remove the affected emSign root certificates, and the python-certifi project also published an advisory (GHSA-6q48-6c7w-9gw2) removing the emSign root certificates in version 2026.10.18. A dedicated status tracking website (emudhra.we-have-a-problem.com) was established by the security community to monitor vendor responses and provide test hosts using affected certificates (Red Hat Security Bulletin, Red Hat Bugzilla).