Vulnerabilities
Misconfiguration
Compliance
Cryptography
CVE Vulnerabilities

CVE-2026-114406

Improper Certificate Validation

Published: Oct 21, 2026 | Modified: Oct 30, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6.8 CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Ubuntu
Vulnerability-free packages from our partners
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-114406
CWEhttps://cwe.mitre.org/data/definitions/295.html

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.

Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

NameVendorStart VersionEnd Version
Red Hat Enterprise Linux 10RedHatca-certificates-0:2026.2.92_v9.0.319-100.3.el10_2*
Red Hat Enterprise Linux 10.0 Extended Update SupportRedHatca-certificates-0:2026.2.92_v9.0.319-100.3.el10_0*
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRedHatca-certificates-0:2026.2.92_v9.0.319-60.3.el6_10*
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRedHatnss-0:3.44.0-15.el6_10*
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRedHatca-certificates-0:2026.2.92_v9.0.319-70.3.el7_9*
Red Hat Enterprise Linux 8RedHatca-certificates-0:2026.2.92_v9.0.319-81.3.el8_10*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatca-certificates-0:2026.2.92_v9.0.319-80.3.el8_4*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatca-certificates-0:2026.2.92_v9.0.319-80.3.el8_6*
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRedHatca-certificates-0:2026.2.92_v9.0.319-80.3.el8_6*
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRedHatca-certificates-0:2026.2.92_v9.0.319-80.3.el8_8*
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRedHatca-certificates-0:2026.2.92_v9.0.319-80.3.el8_8*
Red Hat Enterprise Linux 9RedHatca-certificates-0:2026.2.92_v9.0.319-90.3.el9_8*
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRedHatca-certificates-0:2026.2.92_v9.0.319-90.3.el9_2*
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRedHatca-certificates-0:2026.2.92_v9.0.319-90.3.el9_4*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatca-certificates-0:2026.2.92_v9.0.319-90.3.el9_6*
Red Hat OpenShift Container Platform 4.12RedHatopenshift/ose-rhel-coreos-8:412.86.202610250235-0*
Red Hat OpenShift Container Platform 4.14RedHatopenshift/ose-rhel-coreos-9:414.92.202610242240-0*
Red Hat OpenShift Container Platform 4.16RedHatopenshift/ose-rhel-coreos-9:416.94.202610242150-0*
Red Hat OpenShift Container Platform 4.18RedHatopenshift/ose-rhel-coreos-9:418.94.202610242013-0*
Red Hat OpenShift Container Platform 4.19RedHatopenshift/ose-rhel-coreos-9:4.19.9.6.202610241701-0*
Red Hat OpenShift Container Platform 4.20RedHatopenshift/ose-rhel-coreos-9:4.20.9.6.202610242033-0*
Red Hat OpenShift Container Platform 4.21RedHatopenshift/ose-rhel-coreos-9:4.21.9.6.202610241345-0*
Red Hat OpenShift Container Platform 4.22RedHatopenshift/ose-rhel-coreos-9:4.22.9.8.202610241758-0*
Red Hat OpenStack Platform 13.0 - ELSRedHatpython-botocore-0:1.8.33-2.el7ost*
Red Hat OpenStack Platform 16.2RedHatpython-botocore-0:1.12.119-4.el8ost*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatpython-botocore-0:1.20.68-2.el9ost*
Red Hat OpenStack Services on OpenShift 18.0RedHatpython-botocore-0:1.27.89-3.el9ost*
Agentic cluster security suite 0.2RedHatagentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9:1793102187*
Red Hat Advanced Cluster Security for Kubernetes 4.10RedHatadvanced-cluster-security/rhacs-central-db-rhel8:1793184257*
Red Hat Hardened ImagesRedHatca-certificates-main-2026.2.92_v9.0.319-1.hum1*
Red Hat OpenShift AI 3.0RedHatrhai/base-image-spyre-rhel9:1793041986*
Red Hat OpenShift AI 3.0RedHatrhai/base-image-rocm-rhel9:1793041981*
Red Hat OpenShift AI 3.0RedHatrhai/base-image-cpu-rhel9:1793042072*
Red Hat OpenShift AI 3.0RedHatrhai/base-image-cuda-rhel9:1793042067*
Red Hat OpenShift AI 3.0RedHatrhai/base-image-tpu-rhel9:1793041987*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-rocm-7.1-rhel9:1793042006*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-cuda-12.9-rhel9:1793042145*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-tpu-rhel9:1793042006*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-gaudi-rhel9:1793042011*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-cuda-13.0-rhel9:1793042086*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-cpu-rhel9:1793042088*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-rocm-6.4-rhel9:1793041995*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-spyre-rhel9:1793042074*
Red Hat OpenShift AI 3.4RedHatrhai/base-image-neuron-rhel9:1793042008*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-tpu-rhel9:1793042010*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-cpu-rhel9:1793042162*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-gaudi-rhel9:1793042004*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-rubin-rhel9:1793042092*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-cuda-12.9-rhel9:1793042117*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-cuda-13.0-rhel9:1793042093*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-spyre-rhel9:1793042114*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-rocm-7.14-rhel9:1793042024*
Red Hat OpenShift AI 3.5RedHatrhai/base-image-neuron-rhel9:1793042008*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-controller-rhel9:1792840135*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-git-cloner-rhel9:1792835365*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-image-bundler-rhel9:1792835298*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-image-processing-rhel9:1792836805*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-rhel9-operator:1792844269*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-shared-resource-rhel9:1792837466*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-shared-resource-webhook-rhel9:1792838794*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-waiters-rhel9:1792837567*
Red Hat OpenShift Builds 1.8.3RedHatopenshift-builds/openshift-builds-webhook-rhel9:1792851895*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-controller-rhel10:1792837598*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-git-cloner-rhel10:1792837398*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-image-bundler-rhel10:1792838765*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-image-processing-rhel10:1792835879*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-rhel10-operator:1792859629*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-shared-resource-rhel10:1792857112*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-shared-resource-webhook-rhel10:1792840655*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-waiters-rhel10:1792839475*
Red Hat OpenShift Builds 1.9.2RedHatopenshift-builds/openshift-builds-webhook-rhel10:1792835571*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/udi-base-rhel10:1793043152*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/code-rhel9:1793055196*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/code-sshd-rhel9:1793053893*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/configbump-rhel9:1793033767*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/dashboard-rhel9:1793040801*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/devspaces-rhel9-operator:1793033165*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/imagepuller-rhel9:1793036189*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/jetbrains-ide-rhel9:1793036500*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/multicluster-redirector-rhel9:1793037970*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/oauth2-proxy-rhel9:1793034989*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/openvsx-rhel9:1793038501*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/pluginregistry-rhel9:1793050419*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/server-rhel9:1793041480*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/traefik-rhel9:1793033496*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/udi-base-rhel9:1793041345*
Red Hat OpenShift Dev Spaces 3.31RedHatdevspaces/udi-rhel9:1793120195*
Red Hat Update Infrastructure 5RedHatrhui5/cds-kubernetes-rhel9:1793005771*
Red Hat Update Infrastructure 5RedHatrhui5/cds-rhel9:1793005764*
Red Hat Update Infrastructure 5RedHatrhui5/haproxy-rhel9:1793004999*
Red Hat Update Infrastructure 5RedHatrhui5/installer-rhel9:1793004989*
Red Hat Update Infrastructure 5RedHatrhui5/rhua-rhel9:1793005812*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use