CVE-2026-114406 in Advanced Cluster Management for Kubernetes
Summary
by MITRE • 10/21/2026
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified involves a critical failure in the trust chain management within Red Hat products distributed via ca-certificates RPM packages. The core issue stems from the inclusion of multiple root Certificate Authority (CA) certificates in the system-wide certificate store that were associated with intermediate CA certificates issued by eMudhra. These specific intermediate CAs possessed weak private keys, a fundamental cryptographic flaw that compromises the integrity of any digital identity signed using them. In public key infrastructure systems, the strength of the entire chain relies on the weakest link; when an intermediate CA's private key is compromised or deemed cryptographically insufficient due to weakness, all certificates issued by it lose their verifiable authenticity and trustworthiness.
A man-in-the-middle attacker exploiting this flaw could generate fraudulent X.509 certificates for arbitrary host names using the weak eMudhra intermediate keys. Because these root CAs were present in the system CA store, TLS/SSL clients on affected systems would automatically validate and trust these maliciously issued certificates as legitimate. This effectively allows an attacker to perform SSL stripping or active interception attacks without triggering certificate warnings in browsers or other secure communication applications. The victim's client establishes a seemingly encrypted connection with the attacker, who can then decrypt, inspect, modify, or inject traffic before re-encrypting it and forwarding it to the intended destination, thereby breaking confidentiality and integrity guarantees essential for secure web browsing and API communications.
This incident represents a severe breach of trust in the certificate authority ecosystem, aligning closely with CWE-295 Improper Certificate Validation and CWE-326 Inadequate Encryption Strength. From an ATT&CK perspective, this vulnerability facilitates techniques related to Credential Access via Steal Web Session Cookie or Defense Evasion through Masquerading as a trusted service. The inability of most TLS/SSL clients to selectively distrust specific intermediate certificates while retaining trust in the root CA necessitates a broader remediation strategy. Consequently, the affected root CA certificates have been removed from the system store entirely rather than attempting granular revocation at the intermediate level. This approach ensures that no certificate signed by any intermediate CA under those compromised roots is accepted as valid, thereby eliminating the attack surface associated with these specific weak keys across all dependent applications and services within the Red Hat ecosystem.