The system certificate authority store shipped in Red Hat products contained root certificates that signed intermediate certificates issued by the eMudhra authority. Those intermediate certificates used weak private keys, allowing an attacker to generate and sign arbitrary TLS certificates for any hostname. Clients that rely on the system trust store would accept these forged certificates as valid, enabling a man‑in‑the‑middle attack that compromises confidentiality and integrity of TLS connections. The weakness is an improper restriction of certificate authority and is classified as CWE‑295.

The flaw affects all Red Hat products that use the ca‑certificates RPM, including Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, OpenShift Serverless, OpenShift Service Mesh, Red Hat Advanced Cluster Security, Red Hat Advanced Cluster Management, and various other Red Hat operators and subsystems. The root CA certificates that signed the weak intermediate certificates have been removed from the latest ca‑certificates package, but older or unpatched systems remain vulnerable.

The vulnerability has a CVSS score of 6.8, indicating a moderate risk. EPSS information is not available, and the flaw is not listed in CISA’s KEV catalog. Because the attack vector relies on the system trust store, a remote attacker can issue forged certificates to any host that uses the vulnerable ca‑certificates package. The exploit requires no privileged access and can be executed over the network by creating and delivering malicious certificates that clients will trust.