On 20 October 2026, it was disclosed that the private keys for eight eMudhra intermediate CA certificates were incorrectly generated and can be recovered by anyone. An attacker could use them to impersonate websites and services to clients that trust these CAs. Mozilla, Chrome, Apple and Microsoft have already blocked the affected intermediates in their browsers and operating systems, but many other clients do not check revocation and only stop trusting them once their CA bundle is updated.
This is not a compromise of Cloudsmith or of your artifacts. The risk comes from software that bundles or consumes a CA trust store. Artifacts that include a bundle from before the fix will still trust the compromised intermediates, wherever they are hosted.
| Format | Package | Fixed version |
|---|---|---|
| Debian | ca-certificates (Debian) | 20250419~deb12u2, 20250419+deb13u1, 20260816+nmu1 |
| Debian | ca-certificates (Ubuntu) | 20260816ubuntu0.22.04.1, 0.24.04.1, 0.26.04.1, 0.26.10.1 |
| RedHat | ca-certificates (Fedora) | 2026.2.92_v9.0.319 |
| Alpine | ca-certificates | 20261020-r0 |
| Python | certifi | 2026.10.19 |
| Python | pip | 26.2.2 |
| Python | uv | 0.13.4 |
| Cargo | rustls-webpki | 0.103.16 |
| Cargo | webpki-roots / webpki-root-certs | 1.0.10 |
| npm | Electron | 44.9.1, 43.8.1, 42.11.16 |
| Composer | composer/ca-bundle | 1.4.16, 1.6.0 |
| Hex | castore | 1.0.22 |
| Raw / Generic | Go toolchain | 1.27.3, 1.26.10 |
| Raw / Generic | curl CA bundle | 2026-10-20 |
| Docker / OCI | Base images | Rebuild on a base with a fixed ca-certificates package |
Not yet fixed at the time of writing: Node.js, Bun and FreeBSD ca_root_nss. If you rely on these, please check the vendor for updates and consider the manual workarounds in the incident write-up.
1. Review the packages and images and update to the fixed versions.
2. Rebuild and republish container images rather than patching running hosts, since images and packages are immutable.
3. Check for pinned or vendored bundles (lockfiles, hash-pinned dependencies, copied cacert.pem files), which will not update automatically.
4. Update the trust store on build agents, CI runners and any clients that pull from Cloudsmith.
5. If you use private upstreams secured with eMudhra-issued certificates, review those connections.
6. Optionally, use Cloudsmith vulnerability scanning and policy as code to flag or block outdated CA bundles in your repositories.
Please note that the fixed versions above come from the public incident write-up at https://emudhra.we-have-a-problem.com/ and the vendors' own advisories. We recommend confirming against each vendor's advisory for your specific versions.
If you'd like further detailed information on the specific packages detected on your account, please feel free to reach out.
