critical severityConfidence highHistorical record

eMudhra CA keys leaked: forged HTTPS certificates still pass in unpatched Go, Python, Node.js and Java (CVE-2026-111943)

eMudhra created eight intermediate CAs (EM DV, OV and EV TLS CA G3B and G3C, plus EM OV CS CA G3B and G3C) at an April 30, 2025 key ceremony with P-384 private keys below 256, so anyone can recover them from the public certificates. Sectigo cross-signed all eight under AAA Certificate Services. A researcher proved key control to the root programs on October 17, 2026. Chrome, Firefox, Apple and Microsoft blocked the intermediates through CRLSet, OneCRL and their own channels between October 17 and 20, eMudhra revoked them on October 18 and Sectigo revoked the cross-signs on October 19. Mozilla and Chrome are removing emSign ECC Root CA - G3. Clients outside the browser that skip revocation and Certificate Transparency, including Go, Python certifi, Node.js, Java cacerts, Linux ca-certificates and macOS /etc/ssl/cert.pem, accept forged certificates for any hostname until updated: Go 1.27.3/1.26.10 (CVE-2026-111943), certifi 2026.10.18+, Node.js 22.23.4/24.22.1/26.12.1, NSS 3.131.1 and distro ca-certificates updates.

Also tracked as CVE-2026-111943 · GO-2026-6809 · GHSA-6q48-6c7w-9gw2 · eMudhra intermediate CA compromise · emSign ECC Root CA - G3 distrust · EM DV TLS CA - G3B · Mozilla Bug 2083449 · we have a problem eMudhra

First observed
Oct 17, 2026
Last observed
Oct 21, 2026
Last reviewed
Oct 21, 2026
Tracking ended
Oct 21, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

No forged certificate from these keys has been observed in Certificate Transparency or reported in use, but several people recovered the keys independently and unlogged certificates would work against non-CT clients. eMudhra's root-cause investigation is ongoing. Java vendor and Bun updates were pending at time of writing.

  • Up-to-date Chrome, Firefox, Safari and Edge users are protected and enforce Certificate Transparency.
  • Certificates under eMudhra's RSA root emSign Root CA - G1 are not affected by this distrust.
  • eMudhra's India DSC and eSign services are reported as unaffected.
  • This is a CA key-generation failure, not a code bug in Go, OpenSSL or Python.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard does not inspect TLS trust stores or certificate chains; this campaign is guidance only.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Update

    eMudhra key ceremony creates 24 intermediates; the eight P-384 keys in the B and C series get private keys below 256.

  2. Update

    Sectigo cross-signs all eight intermediates under AAA Certificate Services.

  3. First observed

    Researcher reports proof of private-key control for all eight intermediates to Apple, Chrome, Microsoft, Mozilla and eMudhra.

  4. Vendor action

    Chrome lands a CRLSet update blocking the six TLS intermediates by SPKI hash.

  5. Update

    Mozilla independently recovers the private keys, confirming the key generation flaw.

  6. Vendor action

    Firefox OneCRL block reaches all users with standard settings.

  7. Vendor action

    eMudhra revokes all eight intermediates with reason caCompromise (09:24 to 09:39 UTC).

  8. Registry action

    certifi 2026.10.18 published to PyPI without emSign ECC Root CA - G3.

  9. Vendor action

    Sectigo revokes the eight cross-signed certificates; Apple blocks the intermediates the same day.

  10. Disclosure

    Mozilla notifies downstream trust store operators and recommends distrusting the affected roots where intermediates cannot be blocked.

  11. Vendor action

    Go 1.27.3 and 1.26.10 add a crypto/x509 denylist for the compromised keys (CVE-2026-111943).

  12. Disclosure

    October 20 (date only): public disclosure; Mozilla and Chrome announce emergency removal of emSign ECC Root CA - G3, NSS 3.131.1 and Firefox 158.0.1 ship, Microsoft blocks the intermediates.

  13. Vendor action

    Node.js 22.23.4, 24.22.1 and 26.12.1 reject chains with the blocked keys and update roots to NSS 3.131.1.

  14. Guard update

    HOL publishes the operator write-up with per-runtime fix and check commands.

Publication clock: 43.4 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • stdlib (crypto/x509)@< 1.26.10, >= 1.27.0-0 < 1.27.3gopackage
  • certifi@>= 2019.03.09, < 2026.10.18pypipackage
  • Node.js@< 22.23.4 (22.x), < 24.22.1 (24.x), < 26.12.1 (26.x)genericpackage
  • Mozilla NSS@< 3.131.1genericpackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-BEB0B59F