CVE-2026-114406: Red Hat CA store: weak eMudhra intermediates enable TLS MITM

Red Hat removed several root CAs from the system ca-certificates store because intermediate CAs issued by eMudhra had weak private keys. An attacker who recovers those keys could mint trusted certificates for any hostname and intercept TLS traffic from any client that uses the system trust store. The AI relevance is indirect but wide: the advisory lists more than 200 Red Hat container images, including OpenShift AI (rhoai) model-serving and pipeline images, RHEL AI vLLM inference images and base images. Real-world risk is moderated by the high attack complexity (the attacker must sit on the network path), the user interaction requirement, a medium CVSS of 6.8, no KEV listing, no public exploit and no Nuclei template. Apply the RHSA errata (for example RHSA-2026:86595), rebuild or pull refreshed container images so the updated CA bundle is included, and verify the removed roots no longer appear in /etc/pki/ca-trust.

No confirmed active exploitation of CVE-2026-114406 has been reported, but organizations should still patch proactively.

1) Apply the Red Hat errata for ca-certificates and nss (RHSA-2026:86595, 88455, 88459, 88550, 88560, 88562, 88563, 88564, 88662, 88668) on RHEL hosts and CoreOS nodes. 2) Rebuild and redeploy any custom images derived from the affected rhai, rhaii, rhoai, rhelai3, devspaces, openshift-builds and gitops base images, and pull the refreshed versions of Red Hat images. 3) Confirm the update with trust list or by inspecting /etc/pki/ca-trust/extracted to verify the removed root CAs are absent. 4) Audit custom trust bundles, language-specific stores (certifi, Java keystores, Node) and any images that bundle their own CA files, since they will not pick up the RPM fix. 5) Test integrations that rely on certificates chaining to the removed roots (for example eMudhra-issued certificates for Indian government or enterprise services) before wide rollout, because they may begin to fail. 6) Detection: monitor Certificate Transparency logs and TLS inspection telemetry for unexpected certificates issued by eMudhra intermediates, and enable certificate pinning for high-value endpoints such as model registries and artifact stores.

This vulnerability affects the following AI/ML architecture patterns: Model serving and inference platforms, Training and data science pipelines, Container base images for AI workloads, Notebook and workbench environments, Model registries and artifact stores, Kubernetes and OpenShift AI platforms, Agent and MCP lifecycle infrastructure.

CVE-2026-114406 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.31%.