On this page

eMudhra CA keys compromised: update trust stores and check certificate chains

By Tornike@realtornikeoPublished Nov 4, 2026Last updated Nov 4, 2026

Original sources: eMudhra: incident statement and customer transition; Mozilla: Firefox and NSS protections; Red Hat: affected products and trust-store updates; Cloudflare: observations of forged certificates

Does this apply to me?

Firefox and NSSExposure depends on trust-list updates and configuration: Standard Firefox configurations received a remote blocklist update. Custom settings can prevent that update.Action: Firefox 158.0.1, ESR 115.43.1 and 153.5.1; Android 158.0.2 addresses a blocklist startup issue. NSS 3.131.1 updates its trust store.
Red Hat Enterprise Linux trust storeRHEL 6, 7, 8, 9 and 10 with an affected ca-certificates package: TLS applications using a trust store that still accepts the compromised hierarchy.Action: Apply the updated ca-certificates package for the deployed release; check Red Hat's advisory.

How severe is it?

Critical for exposed trust paths

An attacker able to intercept a connection could use a forged certificate to impersonate a service and read or change traffic if the client accepts it. Red Hat rates its affected products Critical.

Red Hat's product rating and Tornike's assessment of unprotected TLS clients. The interception risk depends on trust and network position.

First reported Oct 17, 2026

CVE-2026-114406

What happened

On October 17, 2026, Mozilla received a report that eight eMudhra intermediate CA private keys were compromised. eMudhra attributes the weak keys to a script error and says it revoked the intermediates on October 18. Mozilla and other vendors changed their trust lists.

TLS clients that still trust the affected hierarchy can accept forged certificates. Trust decisions vary by application, operating system and configuration. Website certificates chaining to removed roots can also stop working for updated clients.

What to do now

Update OS and application trust stores. Rebuild containers with updated base images and redeploy them. Check separately bundled trust stores.
Check the full certificate chains served by your websites and APIs. Replace certificates that depend on roots removed by clients, or use an alternative trusted chain.
Verify the actual TLS path used by each service, including outbound API clients. A browser update alone does not establish that a server application is protected.

What this means for your website

Cloudflare observed forged certificates after disclosure and reported no evidence that they intercepted its connections. eMudhra says the affected intermediates had issued no publicly trusted end-entity certificates. Broader distrust can still disrupt legitimate sites using other certificates under affected roots.

Sources and updates

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →