/
← Voltar ao feed
critical

Private keys of eight eMudhra intermediate certificates compromised, enabling forged TLS certificates for any domain

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 19:20 · coletado há 1 hora

On October 19, 2026, Cloudflare learned that the private keys of eight eMudhra intermediate certificates had been compromised. The certificates were widely trusted by browsers, operating systems and Cloudflare itself. Because the keys are weak, an attacker could forge a certificate for any domain and impersonate servers to intercept or modify traffic. Cloudflare patched critical services ahead of public disclosure and reports no active exploitation on its services. Customers must still update client software, trust stores and origin configurations.

Technical Details

  • The issue is a weakness in certificate-based authentication in the WebPKI, not in TLS encryption algorithms.
  • Cloudflare prioritized services that use public certificates to authenticate remote endpoints, such as proxies connecting to origins and applications calling external APIs. It also updated shared trust stores and base images, and deployed the reloads, restarts and image deployments needed to activate them.
  • Applications with bundled or custom trust stores need separate assessment. An SDK update alone may not change the underlying verification policy, because API clients may delegate to an HTTP library, a language runtime, the OS or a custom trust configuration.
  • Browsers could mitigate quickly through revocation mechanisms such as Chrome CRLSets, which most other software stacks lack.
  • Mozilla's Dennis Jackson crowdsourced a list of patched packages and runs a test site covering browser and non-browser verification paths.

Remediation

  • Upgrade Cloudflare One Client to v2.5.6 (Android), v1.12.16 (iOS), and 2026.8.2115.0 (Windows, macOS, Linux). The iOS Cloudflare One Agent update is still pending app review.
  • Upgrade the 1.1.1.1 app to v6.38.10 (Android), v6.31.7 (iOS), and 2026.8.2115.0 (Windows, macOS, Linux).
  • Update cloudflared (Cloudflare Tunnel). Customers on Cloudflare Zero Trust Gateway with an up-to-date client are automatically protected.
  • Review Cloudflare Containers and Sandboxes images and dependencies for affected trust stores, or enable HTTPS egress interception.
  • Update dependencies (including indirect ones), rebuild images, and reload, restart or redeploy applications. Validate through each application's actual TLS path.
  • Do not resolve resulting certificate errors by disabling verification.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 20/10/2026 19:20 · coletado 20/10 20:00 primeiro registro

    Private keys of eight eMudhra intermediate certificates compromised, enabling forged TLS certificates for any domain

    ler a análise desta fonte

    On October 19, 2026, Cloudflare learned that the private keys of eight eMudhra intermediate certificates had been compromised. The certificates were widely trusted by browsers, operating systems and Cloudflare itself. Because the keys are weak, an attacker could forge a certificate for any domain and impersonate servers to intercept or modify traffic. Cloudflare patched critical services ahead of public disclosure and reports no active exploitation on its services. Customers must still update client software, trust stores and origin configurations.

    Technical Details

    • The issue is a weakness in certificate-based authentication in the WebPKI, not in TLS encryption algorithms.
    • Cloudflare prioritized services that use public certificates to authenticate remote endpoints, such as proxies connecting to origins and applications calling external APIs. It also updated shared trust stores and base images, and deployed the reloads, restarts and image deployments needed to activate them.
    • Applications with bundled or custom trust stores need separate assessment. An SDK update alone may not change the underlying verification policy, because API clients may delegate to an HTTP library, a language runtime, the OS or a custom trust configuration.
    • Browsers could mitigate quickly through revocation mechanisms such as Chrome CRLSets, which most other software stacks lack.
    • Mozilla's Dennis Jackson crowdsourced a list of patched packages and runs a test site covering browser and non-browser verification paths.

    Remediation

    • Upgrade Cloudflare One Client to v2.5.6 (Android), v1.12.16 (iOS), and 2026.8.2115.0 (Windows, macOS, Linux). The iOS Cloudflare One Agent update is still pending app review.
    • Upgrade the 1.1.1.1 app to v6.38.10 (Android), v6.31.7 (iOS), and 2026.8.2115.0 (Windows, macOS, Linux).
    • Update cloudflared (Cloudflare Tunnel). Customers on Cloudflare Zero Trust Gateway with an up-to-date client are automatically protected.
    • Review Cloudflare Containers and Sandboxes images and dependencies for affected trust stores, or enable HTTPS egress interception.
    • Update dependencies (including indirect ones), rebuild images, and reload, restart or redeploy applications. Validate through each application's actual TLS path.
    • Do not resolve resulting certificate errors by disabling verification.