CVE-2026-115557
Description
The eMudha certificate authority issues a set of intermediate CA certificates with weak private keys. A man-in-the-middle attacker could use these weak intermediate CA certificates to issue certificates for arbitrary host names and have them accepted by TLS/SSL clients as valid if those clients trusted root certificate authorities which signed these weak intermediate CA certificates. The Python ssl module was modified to reject these weak intermediate CA certificates regardless of whether issues root CAs are trusted.
Security Bulletin
Statement
Red Hat handled the eMudhra intermediate CA certificate compromise by removing issuing root CA certificates from the Red Hat Enterprise Linux system root certificates store provided via the ca-certificates packages. For more details, refer to CVE-2026-114406 and RHSB-2026-012:
https://access.redhat.com/security/cve/CVE-2026-114406 https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
After updating ca-certificates, this Python ssl module change only provides additional hardening, which can only be relevant in use cases when a Python application is configured to use some non-default root certificate store.
Mitigation
Users of Python RPM packages in Red Hat Enterprise Linux can resolve the eMudhra weak intermediate CA certificates issue by installing updated ca-certificates packages fixing CVE-2026-114406.
Also refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
