--- title: "Infisical’s response to the eMudhra certificate authority compromise" canonical: "https://infisical.com/blog/emudhra-certificate-authority-compromise" published: "2026-10-23" tags: ["Certificate Management", "News", "Security"] source-index: https://infisical.com/llms.txt --- # Infisical’s response to the eMudhra certificate authority compromise ## What happened eMudhra generated the private keys for eight of its intermediate certificates in a way that allows anyone to derive them from the public certificates, and the problem was publicly disclosed on October 20, 2026. Anyone holding those keys could issue a certificate for any domain, and software that trusts eMudhra’s root, or the Sectigo root that cross-signed these intermediates, would accept it. Browser and operating system vendors have blocked the affected certificates, and eMudhra has revoked them. Software that relies on its own bundled root store, including many servers, command-line tools and language runtimes, continues to trust them until that root store is updated. The [public disclosure](https://emudhra.we-have-a-problem.com) and [Mozilla’s incident report](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) have the full details. ## Impact on Infisical Infisical was not compromised. None of our certificates come from eMudhra, and no Infisical private keys were exposed. Our products also do not ship with the affected certificates built in. The review is ongoing, and so far we have no indication that the affected certificates were used against Infisical or our customers. Like most software, several Infisical products verify TLS connections against root stores that trusted the affected certificates. That covers the Infisical platform’s outbound connections, such as secret syncs, app connections, dynamic secrets and webhooks, as well as the clients and integrations that connect to Infisical. The updates below stop our software from trusting those certificates. ## What we did We reviewed every product, service and SDK we maintain. - Infisical Cloud and dedicated instances now run on Node.js 26.12.1, which no longer trusts the affected certificates. - We rebuilt our Go-based products on Go 1.26.10 or later and on refreshed base images. Go 1.26.10 rejects certificate chains that include the affected intermediates. - Our Go, Python and Rust SDKs now require patched toolchains or trust bundles. We are also reviewing how our products receive root store updates, so that future changes of this kind reach customers faster. ## What you need to do Infisical Cloud and dedicated instances are already updated. Self-hosted deployments should upgrade to Infisical v0.167.0 and update any of the components below that they run. | Product | Fixed version | Action | | --- | --- | --- | | Infisical Cloud (US and EU) | Updated October 21, 2026 | No action required | | Dedicated instances | Updated October 21, 2026 | No action required | | Infisical self-hosted (Docker image and Linux packages) | v0.167.0 | Upgrade, and update the operating system’s `ca-certificates` package | | Infisical self-hosted (Helm chart) | infisical-standalone 1.11.1, infisical-nkp 0.2.2 | Upgrade the chart | | Infisical CLI and Gateway | v0.44.6 (Gateway Helm chart 1.6.1) | Upgrade | | Infisical Kubernetes Operator | v0.11.13 | Upgrade | | Terraform provider | v0.20.6 | Upgrade | | Crossplane provider | v0.2.1 | Upgrade | | cert-manager issuer | v1.0.1 | Upgrade | | KMIP server | v0.3.21 | Upgrade | | PKCS#11 module | v0.0.6 | Upgrade | | Windows Key Storage Provider | v0.0.3 | Upgrade | | Dagger module | v1.1.1 | Upgrade | | Go SDK | v0.9.0 | Upgrade (requires Go 1.26.10 or later) | | Python SDK | v1.0.18 | Upgrade (requires certifi 2026.10.19 or later) | | Rust SDK | v0.0.4 | Upgrade | | Node.js, Java, .NET, Ruby, PHP and C++ SDKs | No change required | Update the runtime or operating system trust store, as described below | | Secrets GitHub Action | No change required | No action required. TLS verification uses the runner’s Node.js, as described below | | Auth GitHub Action | v1.0.1 | Upgrade, or keep using `@v1`. TLS verification uses the runner’s Node.js, as described below | | Agent Injector | v0.1.13 (Helm chart 0.1.13) | Upgrade | | CSI Provider | v0.0.10 (Helm chart 0.2.4) | Upgrade | | Kubernetes KMS plugin | v0.0.3 | Set the image to `infisical/kubernetes-kms:v0.0.3` | | Packer plugin | v0.0.4 | Upgrade | | Agent Vault | v0.40.2 | Upgrade | ## Runtime and trust store updates Infisical SDKs and many integrations rely on the trust store of the runtime or operating system they run on. Update these alongside Infisical: - Node.js: 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and earlier will not receive this update. - Go: 1.26.10 or 1.27.3, then rebuild your binaries. - Python: certifi 2026.10.19 or later. - Java: a patched JDK is not yet available. We will update this post when one is. - GitHub Actions: JavaScript actions, including Infisical’s, run on the Node.js version bundled with the GitHub Actions runner. The current runner release bundles Node.js 24.21.0, which predates the fix. We will update this post when GitHub ships a runner with Node.js 24.22.1 or later. - Other environments: update the operating system’s `ca-certificates` package and rebuild container images from updated base images. To confirm that a client no longer trusts the affected certificates, run `curl https://dv-g3b-emudhra.we-have-a-problem.com/`. The request should fail with a certificate error. If a service begins returning certificate errors after you update, do not disable certificate verification. The service may be using a certificate that browsers and operating systems no longer trust. ## Timeline All dates are in US Eastern time. | Date | What happened | | --- | --- | | **October 17** | The issue is reported to the browser root programs. Firefox and Chrome block the affected certificates. | | **October 18 to 19** | eMudhra revokes the eight intermediates. Apple blocks them. | | **October 20** | Public disclosure. Microsoft blocks the certificates, and patched Go and Node.js releases ship. The disclosure reaches Infisical’s security team the same day, and we begin reviewing our repositories. | | **October 21** | Infisical Cloud and every dedicated instance are updated, and Infisical v0.167.0 ships for self-hosted deployments, along with fixes for the CLI, Terraform, Crossplane, the Kubernetes and HSM integrations, the Go, Python and Rust SDKs, the Helm charts and the Auth GitHub Action. | | **October 22** | Agent Vault v0.40.1 ships. | ## Contact If you have questions about this incident, contact [security@infisical.com](mailto:security@infisical.com) or your Infisical account team. ## References - [eMudhra intermediate CA compromise disclosure](https://emudhra.we-have-a-problem.com) - [Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)