What happened

eMudhra generated the private keys for eight of its intermediate certificates in a way that allows anyone to derive them from the public certificates, and the problem was publicly disclosed on October 20, 2026. Anyone holding those keys could issue a certificate for any domain, and software that trusts eMudhra’s root, or the Sectigo root that cross-signed these intermediates, would accept it. Browser and operating system vendors have blocked the affected certificates, and eMudhra has revoked them. Software that relies on its own bundled root store, including many servers, command-line tools and language runtimes, continues to trust them until that root store is updated.

The public disclosure and Mozilla’s incident report have the full details.

Impact on Infisical

Infisical was not compromised. None of our certificates come from eMudhra, and no Infisical private keys were exposed. Our products also do not ship with the affected certificates built in. The review is ongoing, and so far we have no indication that the affected certificates were used against Infisical or our customers.

Like most software, several Infisical products verify TLS connections against root stores that trusted the affected certificates. That covers the Infisical platform’s outbound connections, such as secret syncs, app connections, dynamic secrets and webhooks, as well as the clients and integrations that connect to Infisical. The updates below stop our software from trusting those certificates.

What we did

We reviewed every product, service and SDK we maintain.

Infisical Cloud and dedicated instances now run on Node.js 26.12.1, which no longer trusts the affected certificates.
We rebuilt our Go-based products on Go 1.26.10 or later and on refreshed base images. Go 1.26.10 rejects certificate chains that include the affected intermediates.
Our Go, Python and Rust SDKs now require patched toolchains or trust bundles.

We are also reviewing how our products receive root store updates, so that future changes of this kind reach customers faster.

What you need to do

Infisical Cloud and dedicated instances are already updated. Self-hosted deployments should upgrade to Infisical v0.167.0 and update any of the components below that they run.

Product	Fixed version	Action
Infisical Cloud (US and EU)	Updated October 21, 2026	No action required
Dedicated instances	Updated October 21, 2026	No action required
Infisical self-hosted (Docker image and Linux packages)	v0.167.0	Upgrade, and update the operating system’s `ca-certificates` package
Infisical self-hosted (Helm chart)	infisical-standalone 1.11.1, infisical-nkp 0.2.2	Upgrade the chart
Infisical CLI and Gateway	v0.44.6 (Gateway Helm chart 1.6.1)	Upgrade
Infisical Kubernetes Operator	v0.11.13	Upgrade
Terraform provider	v0.20.6	Upgrade
Crossplane provider	v0.2.1	Upgrade
cert-manager issuer	v1.0.1	Upgrade
KMIP server	v0.3.21	Upgrade
PKCS#11 module	v0.0.6	Upgrade
Windows Key Storage Provider	v0.0.3	Upgrade
Dagger module	v1.1.1	Upgrade
Go SDK	v0.9.0	Upgrade (requires Go 1.26.10 or later)
Python SDK	v1.0.18	Upgrade (requires certifi 2026.10.19 or later)
Rust SDK	v0.0.4	Upgrade
Node.js, Java, .NET, Ruby, PHP and C++ SDKs	No change required	Update the runtime or operating system trust store, as described below
Secrets GitHub Action	No change required	No action required. TLS verification uses the runner’s Node.js, as described below
Auth GitHub Action	v1.0.1	Upgrade, or keep using `@v1`. TLS verification uses the runner’s Node.js, as described below
Agent Injector	v0.1.13 (Helm chart 0.1.13)	Upgrade
CSI Provider	v0.0.10 (Helm chart 0.2.4)	Upgrade
Kubernetes KMS plugin	v0.0.3	Set the image to `infisical/kubernetes-kms:v0.0.3`
Packer plugin	v0.0.4	Upgrade
Agent Vault	v0.40.2	Upgrade

Runtime and trust store updates

Infisical SDKs and many integrations rely on the trust store of the runtime or operating system they run on. Update these alongside Infisical:

Node.js: 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and earlier will not receive this update.
Go: 1.26.10 or 1.27.3, then rebuild your binaries.
Python: certifi 2026.10.19 or later.
Java: a patched JDK is not yet available. We will update this post when one is.
GitHub Actions: JavaScript actions, including Infisical’s, run on the Node.js version bundled with the GitHub Actions runner. The current runner release bundles Node.js 24.21.0, which predates the fix. We will update this post when GitHub ships a runner with Node.js 24.22.1 or later.
Other environments: update the operating system’s ca-certificates package and rebuild container images from updated base images.

To confirm that a client no longer trusts the affected certificates, run curl https://dv-g3b-emudhra.we-have-a-problem.com/. The request should fail with a certificate error.

If a service begins returning certificate errors after you update, do not disable certificate verification. The service may be using a certificate that browsers and operating systems no longer trust.

Timeline

All dates are in US Eastern time.

Date	What happened
October 17	The issue is reported to the browser root programs. Firefox and Chrome block the affected certificates.
October 18 to 19	eMudhra revokes the eight intermediates. Apple blocks them.
October 20	Public disclosure. Microsoft blocks the certificates, and patched Go and Node.js releases ship. The disclosure reaches Infisical’s security team the same day, and we begin reviewing our repositories.
October 21	Infisical Cloud and every dedicated instance are updated, and Infisical v0.167.0 ships for self-hosted deployments, along with fixes for the CLI, Terraform, Crossplane, the Kubernetes and HSM integrations, the Go, Python and Rust SDKs, the Helm charts and the Auth GitHub Action.
October 22	Agent Vault v0.40.1 ships.