RHSB-2026-012 Certificate compromise - eMudhra (CVE-2026-114406, CVE-2026-111943, CVE-2026-91403, CVE-2026-113812)

Executive Summary

Multiple third-party intermediate certificates signed by eMudhra have been compromised, affecting trust stores across the industry. Red Hat has released updates for multiple affected products and continues to expedite the revocation of the compromised certificates. An attacker in possession of the private keys could issue fraudulent TLS certificates for any domain, enabling impersonation of websites and interception or modification of encrypted traffic in an adversary-in-the-middle position. The compromised intermediate certificates were signed by an eMudhra root certificate included in the system trust store shipped with Red Hat products via the ca-certificates package. Until the trust store is updated to distrust the affected certificates, systems remain capable of trusting fraudulently issued certificates.

The ca-certificates package provides the system-wide set of trusted root and intermediate CA certificates used by TLS-enabled applications. It is derived from the Mozilla NSS certificate store and is a foundational component for secure communications on Red Hat Enterprise Linux and derivative products.

All Red Hat Enterprise Linux deployments that use TLS — for HTTPS, internal service communication, or any certificate-validated connection — should apply the updated ca-certificates package as soon as it is available.

While this is not a software vulnerability, some CVE identifiers have been assigned to assist with the distribution of preventative updates to trust stores.

Downstream:

CVE-2026-114406 has been assigned to track the relevant changes for the ca-certificates package in Red Hat Enterprise Linux (RHEL). The CVE page is the best place to find the most up to date information for patches as they become available.

Upstream:

• CVE-2026-111943 is tracking this issue within the Go / Golang ecosystem
• CVE-2026-91403 is assigned for java
• CVE-2026-113812 is assigned perl Mozilla::CA

The investigation is ongoing and this bulletin will be updated as new information emerges. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

Affected Products

The following Red Hat product versions include the compromised certificates in their trust store:

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 6

Further, any Red Hat product which is supported on Red Hat Enterprise Linux (including RHEL CoreOS) is also potentially impacted. This includes

• Product containers that are based on the RHEL or UBI container images. These images are updated regularly, and container health indicating whether an update addressing this issue is available can be seen in the Container Health Index, part of the Red Hat Container Catalog. In addition, any customer containers should be rebuilt when the base images are updated.
• Products that pull packages from the RHEL channel (this includes layered products such as Red Hat OpenShift Container Platform, Red Hat OpenStack Platform, Red Hat Virtualization, and others). Please ensure that the underlying RHEL ca-certificates package is current in these product environments.

Detection

Systems are at risk if they have a ca-certificates package installed that still includes trust for the compromised certificates. Check the installed version:

rpm -q ca-certificates

Updated packages that distrust the compromised certificates will be announced in the Updates for Affected Products section below.

Conditions

The compromised keys pose a risk to systems where all of the following conditions are present:

• The system has a ca-certificates package that trusts the compromised eMudhra intermediate certificates
• An attacker possesses one or more of the compromised private keys
• The attacker is in a network position to intercept TLS connections (adversary-in-the-middle)

Mitigation

Overall Guidance

As a protective step, customers can blocklist the related root CAs. The compromised eMudhra intermediates were signed by two root CAs: Comodo AAA Services root and emSign ECC Root CA - G3.

Product-Specific Mitigation Steps

Mitigation steps are available for the following platforms:

• Red Hat Enterprise Linux and Fedora
• Red Hat OpenShift Container Platform
• Agent-based Installer OCP environments

Updates for Affected Products

Red Hat customers running affected versions of these Red Hat products are strongly recommended to update as soon as erratas are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.

FAQ

Q: Is this a software vulnerability in Red Hat products?

A: No. This is a compromise of a third-party Certificate Authority's private keys. Red Hat products are affected because the system trust store includes the eMudhra root certificate that signed the compromised intermediates. Red Hat is publishing trust store updates that distrust the affected certificates.

Q: Are my systems actively being attacked?

A: The compromise of CA private keys enables potential attacks but does not by itself mean any system has been compromised. An attacker would need to be in an adversary-in-the-middle network position and present a fraudulently signed certificate to exploit the compromised keys.

Acknowledgements

Red Hat would like to thank Mozilla for their rapid response and public disclosure regarding this compromise.

References

Mozilla Security Blog

How to use GPG to verify signed content from Product Security