CVE-2026-114406: Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Summary

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Timeline

Oct 21, 2026, 8:56 PM UTCCVE published
Oct 22, 2026, 3:26 AM UTCFirst seen by cve.now
Oct 30, 2026, 6:25 PM UTCRecord last updated

Affected versions

ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
nss
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
ca-certificates
Version range not reported
openshift/ose-rhel-coreos-8
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
python-botocore
Version range not reported
python-botocore
Version range not reported
python-botocore
Version range not reported
python-botocore
Version range not reported
agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9
Version range not reported
advanced-cluster-security/rhacs-central-db-rhel8
Version range not reported
ca-certificates-main
Version range not reported
rhai/base-image-spyre-rhel9
Version range not reported
rhai/base-image-rocm-rhel9
Version range not reported
rhai/base-image-cpu-rhel9
Version range not reported
rhai/base-image-cuda-rhel9
Version range not reported
rhai/base-image-tpu-rhel9
Version range not reported
rhai/base-image-rocm-7.1-rhel9
Version range not reported
rhai/base-image-cuda-12.9-rhel9
Version range not reported
rhai/base-image-tpu-rhel9
Version range not reported
rhai/base-image-gaudi-rhel9
Version range not reported
rhai/base-image-cuda-13.0-rhel9
Version range not reported
rhai/base-image-cpu-rhel9
Version range not reported
rhai/base-image-rocm-6.4-rhel9
Version range not reported
rhai/base-image-spyre-rhel9
Version range not reported
rhai/base-image-neuron-rhel9
Version range not reported
rhai/base-image-tpu-rhel9
Version range not reported
rhai/base-image-cpu-rhel9
Version range not reported
rhai/base-image-gaudi-rhel9
Version range not reported
rhai/base-image-rubin-rhel9
Version range not reported
rhai/base-image-cuda-12.9-rhel9
Version range not reported
rhai/base-image-cuda-13.0-rhel9
Version range not reported
rhai/base-image-spyre-rhel9
Version range not reported
rhai/base-image-rocm-7.14-rhel9
Version range not reported
rhai/base-image-neuron-rhel9
Version range not reported
openshift-builds/openshift-builds-controller-rhel9
Version range not reported
openshift-builds/openshift-builds-git-cloner-rhel9
Version range not reported
openshift-builds/openshift-builds-image-bundler-rhel9
Version range not reported
openshift-builds/openshift-builds-image-processing-rhel9
Version range not reported
openshift-builds/openshift-builds-rhel9-operator
Version range not reported
openshift-builds/openshift-builds-shared-resource-rhel9
Version range not reported
openshift-builds/openshift-builds-shared-resource-webhook-rhel9
Version range not reported
openshift-builds/openshift-builds-waiters-rhel9
Version range not reported
openshift-builds/openshift-builds-webhook-rhel9
Version range not reported
openshift-builds/openshift-builds-controller-rhel10
Version range not reported
openshift-builds/openshift-builds-git-cloner-rhel10
Version range not reported
openshift-builds/openshift-builds-image-bundler-rhel10
Version range not reported
openshift-builds/openshift-builds-image-processing-rhel10
Version range not reported
openshift-builds/openshift-builds-rhel10-operator
Version range not reported
openshift-builds/openshift-builds-shared-resource-rhel10
Version range not reported
openshift-builds/openshift-builds-shared-resource-webhook-rhel10
Version range not reported
openshift-builds/openshift-builds-waiters-rhel10
Version range not reported
openshift-builds/openshift-builds-webhook-rhel10
Version range not reported
devspaces/udi-base-rhel10
Version range not reported
devspaces/code-rhel9
Version range not reported
devspaces/code-sshd-rhel9
Version range not reported
devspaces/configbump-rhel9
Version range not reported
devspaces/dashboard-rhel9
Version range not reported
devspaces/devspaces-rhel9-operator
Version range not reported
devspaces/imagepuller-rhel9
Version range not reported
devspaces/jetbrains-ide-rhel9
Version range not reported
devspaces/multicluster-redirector-rhel9
Version range not reported
devspaces/oauth2-proxy-rhel9
Version range not reported
devspaces/openvsx-rhel9
Version range not reported
devspaces/pluginregistry-rhel9
Version range not reported
devspaces/server-rhel9
Version range not reported
devspaces/traefik-rhel9
Version range not reported
devspaces/udi-base-rhel9
Version range not reported
devspaces/udi-rhel9
Version range not reported
rhui5/cds-kubernetes-rhel9
Version range not reported
rhui5/cds-rhel9
Version range not reported
rhui5/haproxy-rhel9
Version range not reported
rhui5/installer-rhel9
Version range not reported
rhui5/rhua-rhel9
Version range not reported
rhaii-fast/model-opt-cuda-rhel9
Version range not reported
rhaii-fast/vllm-cpu-rhel9
Version range not reported
rhaii-fast/vllm-cuda-rhel9
Version range not reported
rhaii-fast/vllm-gaudi-rhel9
Version range not reported
rhaii-fast/vllm-neuron-rhel9
Version range not reported
rhaii-fast/vllm-omni-cuda-rhel9
Version range not reported
rhaii-fast/vllm-rocm-rhel9
Version range not reported
rhaii-fast/vllm-spyre-rhel9
Version range not reported
rhaii-fast/vllm-tpu-rhel9
Version range not reported
rhaii/model-opt-cuda-rhel9
Version range not reported
rhaii/vllm-cpu-rhel9
Version range not reported
rhaii/vllm-cuda-rhel9
Version range not reported
rhaii/vllm-gaudi-rhel9
Version range not reported
rhaii/vllm-neuron-rhel9
Version range not reported
rhaii/vllm-rocm-rhel9
Version range not reported
rhaii/vllm-spyre-rhel9
Version range not reported
rhaii/vllm-tpu-rhel9
Version range not reported
rhelai3/bootc-aws-cuda-rhel9
Version range not reported
rhelai3/bootc-azure-cuda-rhel9
Version range not reported
rhelai3/bootc-azure-rocm-rhel9
Version range not reported
rhelai3/bootc-cuda-rhel9
Version range not reported
rhelai3/bootc-gaudi-rhel9
Version range not reported
rhelai3/bootc-gcp-cuda-rhel9
Version range not reported
rhelai3/bootc-rocm-rhel9
Version range not reported
rhai/base-image-cpu-stable-rhel9
Version range not reported
rhai/base-image-cuda-stable-rhel9
Version range not reported
rhai/base-image-rocm-stable-rhel9
Version range not reported
rhai/base-image-spyre-stable-rhel9
Version range not reported
rhai/base-image-torch-2.14-cpu-rhel9
Version range not reported
rhai/base-image-torch-2.14-cuda-13.0-rhel9
Version range not reported
rhai-early-access/base-image-rocm-7.1-rhel9
Version range not reported
rhai-early-access/docling-sdk-cuda-rhel9
Version range not reported
rhai-early-access/docling-serve-cuda-rhel9
Version range not reported
rhai/guidellm-rhel9
Version range not reported
rhoai/odh-ai-gateway-operator-rhel9
Version range not reported
rhoai/odh-ai-gateway-payload-processing-e2e-rhel9
Version range not reported
rhoai/odh-ai-gateway-payload-processing-rhel9
Version range not reported
rhoai/odh-authbridge-proxy-rhel9
Version range not reported
rhoai/odh-automl-rhel9
Version range not reported
rhoai/odh-autorag-rhel9
Version range not reported
rhoai/odh-built-in-detector-rhel9
Version range not reported
rhoai/odh-caikit-nlp-rhel9
Version range not reported
rhoai/odh-caikit-tgis-serving-rhel9
Version range not reported
rhoai/odh-codeflare-operator-rhel9
Version range not reported
rhoai/odh-core-bff-rhel9
Version range not reported
rhoai/odh-dashboard-operator-rhel9
Version range not reported
rhoai/odh-dashboard-rhel9
Version range not reported
rhoai/odh-data-science-pipelines-argo-argoexec-rhel9
Version range not reported
rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9
Version range not reported
rhoai/odh-data-science-pipelines-operator-controller-rhel9
Version range not reported
rhoai/odh-eval-hub-rhel9
Version range not reported
rhoai/odh-feast-module-operator-rhel9
Version range not reported
rhoai/odh-feast-operator-rhel9
Version range not reported
rhoai/odh-feature-server-rhel9
Version range not reported
rhoai/odh-fms-guardrails-orchestrator-rhel9
Version range not reported
rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
Version range not reported
rhoai/odh-kf-notebook-controller-rhel9
Version range not reported
rhoai/odh-kserve-agent-rhel9
Version range not reported
rhoai/odh-kserve-autogluon-server-rhel9
Version range not reported
rhoai/odh-kserve-controller-rhel9
Version range not reported
rhoai/odh-kserve-llmisvc-controller-rhel9
Version range not reported
rhoai/odh-kserve-localmodel-controller-rhel9
Version range not reported
rhoai/odh-kserve-localmodelnode-agent-rhel9
Version range not reported
rhoai/odh-kserve-module-operator-rhel9
Version range not reported
rhoai/odh-kserve-router-rhel9
Version range not reported
rhoai/odh-kserve-storage-initializer-rhel9
Version range not reported
rhoai/odh-kube-auth-proxy-rhel9
Version range not reported
rhoai/odh-kuberay-operator-controller-rhel9
Version range not reported
rhoai/odh-kube-rbac-proxy-rhel9
Version range not reported
rhoai/odh-kueue-controller-rhel9
Version range not reported
rhoai/odh-latency-predictor-prediction-rhel9
Version range not reported
rhoai/odh-latency-predictor-training-rhel9
Version range not reported
rhoai/odh-llama-stack-core-rhel9
Version range not reported
rhoai/odh-llama-stack-k8s-operator-rhel9
Version range not reported
rhoai/odh-llm-d-async-rhel9
Version range not reported
rhoai/odh-llm-d-batch-gateway-apiserver-rhel9
Version range not reported
rhoai/odh-llm-d-batch-gateway-gc-rhel9
Version range not reported
rhoai/odh-llm-d-batch-gateway-operator-rhel9
Version range not reported
rhoai/odh-llm-d-batch-gateway-processor-rhel9
Version range not reported
rhoai/odh-llm-d-inference-scheduler-rhel9
Version range not reported
rhoai/odh-llm-d-kv-cache-rhel9
Version range not reported
rhoai/odh-llm-d-router-disagg-sidecar-rhel9
Version range not reported
rhoai/odh-llm-d-router-endpoint-picker-rhel9
Version range not reported
rhoai/odh-llm-d-routing-sidecar-rhel9
Version range not reported
rhoai/odh-maas-api-rhel9
Version range not reported
rhoai/odh-maas-controller-rhel9
Version range not reported
rhoai/odh-mcp-lifecycle-module-operator-rhel9
Version range not reported
rhoai/odh-mcp-lifecycle-operator-rhel9
Version range not reported
rhoai/odh-mlflow-operator-rhel9
Version range not reported
rhoai/odh-mlflow-rhel9
Version range not reported
rhoai/odh-mlmd-grpc-server-rhel9
Version range not reported
rhoai/odh-ml-pipelines-api-server-v2-rhel9
Version range not reported
rhoai/odh-ml-pipelines-driver-rhel9
Version range not reported
rhoai/odh-ml-pipelines-launcher-rhel9
Version range not reported
rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9
Version range not reported
rhoai/odh-ml-pipelines-runtime-generic-rhel9
Version range not reported
rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9
Version range not reported
rhoai/odh-mlserver-cuda-rhel9
Version range not reported
rhoai/odh-mlserver-rhel9
Version range not reported
rhoai/odh-mm-rest-proxy-rhel9
Version range not reported
rhoai/odh-mod-arch-agent-ops-rhel9
Version range not reported
rhoai/odh-mod-arch-automl-rhel9
Version range not reported
rhoai/odh-mod-arch-autorag-rhel9
Version range not reported
rhoai/odh-mod-arch-eval-hub-rhel9
Version range not reported
rhoai/odh-mod-arch-gen-ai-rhel9
Version range not reported
rhoai/odh-mod-arch-maas-rhel9
Version range not reported
rhoai/odh-mod-arch-mlflow-rhel9
Version range not reported
rhoai/odh-mod-arch-model-registry-rhel9
Version range not reported
rhoai/odh-model-controller-rhel9
Version range not reported
rhoai/odh-modelmesh-rhel9
Version range not reported
rhoai/odh-modelmesh-runtime-adapter-rhel9
Version range not reported
rhoai/odh-modelmesh-serving-controller-rhel9
Version range not reported
rhoai/odh-model-metadata-collection-rhel9
Version range not reported
rhoai/odh-model-performance-data-rhel9
Version range not reported
rhoai/odh-model-registry-job-async-upload-rhel9
Version range not reported
rhoai/odh-model-registry-operator-rhel9
Version range not reported
rhoai/odh-model-registry-rhel9
Version range not reported
rhoai/odh-model-serving-api-rhel9
Version range not reported
rhoai/odh-must-gather-rhel9
Version range not reported
rhoai/odh-notebook-controller-rhel9
Version range not reported
rhoai/odh-ogx-core-rhel9
Version range not reported
rhoai/odh-ogx-k8s-operator-rhel9
Version range not reported
rhoai/odh-ogx-module-operator-rhel9
Version range not reported
rhoai/odh-openvino-model-server-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Version range not reported
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Version range not reported
rhoai/odh-pipelines-components-rhel9
Version range not reported
rhoai/odh-rhaii-cluster-validator-rhel9
Version range not reported
rhoai/odh-rhaii-validator-tools-rhel9
Version range not reported
rhoai/odh-rhel9-operator
Version range not reported
rhoai/odh-spark-operator-rhel9
Version range not reported
rhoai/odh-ta-lmes-driver-rhel9
Version range not reported
rhoai/odh-ta-lmes-job-rhel9
Version range not reported
rhoai/odh-th06-cpu-torch210-py312-rhel9
Version range not reported
rhoai/odh-th06-cpu-torch291-py312-rhel9
Version range not reported
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Version range not reported
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Version range not reported
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Version range not reported
rhoai/odh-th-torch-cpu-py312-rhel9
Version range not reported
rhoai/odh-th-torch-cuda-py312-rhel9
Version range not reported
rhoai/odh-th-torch-rocm-py312-rhel9
Version range not reported
rhoai/odh-trainer-rhel9
Version range not reported
rhoai/odh-training-cuda121-torch24-py311-rhel9
Version range not reported
rhoai/odh-training-cuda124-torch25-py311-rhel9
Version range not reported
rhoai/odh-training-cuda128-torch28-py312-rhel9
Version range not reported
rhoai/odh-training-cuda128-torch29-py312-rhel9
Version range not reported
rhoai/odh-training-operator-rhel9
Version range not reported
rhoai/odh-training-rocm62-torch24-py311-rhel9
Version range not reported
rhoai/odh-training-rocm62-torch25-py311-rhel9
Version range not reported
rhoai/odh-training-rocm64-torch28-py312-rhel9
Version range not reported
rhoai/odh-training-rocm64-torch29-py312-rhel9
Version range not reported
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
Version range not reported
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Version range not reported
rhoai/odh-trustyai-service-operator-rhel9
Version range not reported
rhoai/odh-trustyai-service-rhel9
Version range not reported
rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9
Version range not reported
rhoai/odh-vllm-cuda-rhel9
Version range not reported
rhoai/odh-vllm-gaudi-rhel9
Version range not reported
rhoai/odh-vllm-rocm-rhel9
Version range not reported
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Version range not reported
rhoai/odh-workbenches-operator-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Version range not reported
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Version range not reported
rhoai/odh-workload-variant-autoscaler-controller-rhel9
Version range not reported
rhoai/rhai-cli-rhel9
Version range not reported
openshift/ose-rhel-coreos-9
Version range not reported
openshift-gitops-1/argocd-agent-rhel9
Version range not reported
openshift-gitops-1/argocd-image-updater-rhel9
Version range not reported
openshift-gitops-1/argocd-rhel9
Version range not reported
openshift-gitops-1/argo-rollouts-rhel9
Version range not reported
openshift-gitops-1/dex-rhel9
Version range not reported
openshift-gitops-1/gitops-promoter-rhel9
Version range not reported
openshift-gitops-1/gitops-rhel9
Version range not reported
openshift-gitops-1/gitops-rhel9-operator
Version range not reported

References 28

access.redhat.com

bugzilla.redhat.com

show_bug.cgi?id=2556046