Cloudflare: 8 eMudhra certificates compromised, WARP and cloudflared updates issued
Cloudflare says eight eMudhra intermediate certificate keys are compromised. It has released WARP, 1.1.1.1 and cloudflared updates and lists what customers must check.
Cloudflare says private keys tied to eight eMudhra intermediate certificates were compromised, and it has shipped updates for its Cloudflare One (WARP/1.1.1.1) clients and Cloudflare Tunnel (cloudflared) as a result. The company says it became aware of the issue on October 19, 2026, at approximately 17:00 UTC.
According to Cloudflare, the certificates were widely trusted by browsers, operating systems and within Cloudflare itself. Because the keys are weak, the company says an attacker could create a forged certificate for any domain and use it to impersonate servers, intercepting or modifying traffic. Cloudflare calls it “a serious security incident with implications across the Internet.”
Cloudflare says its security review has not identified active exploitation of the issue on its services, and that it prioritized patching critical services before public disclosure. The company notes this work addresses certificate-based authentication, not a weakness in TLS’s encryption algorithms.
Which versions to install
If you use Cloudflare’s client software, the fixed builds are:
- Cloudflare One Client: v2.5.6 (Android), v1.12.16 (iOS), and 2026.8.2115.0 on Windows, macOS and Linux
- 1.1.1.1 app: v6.38.10 (Android), v6.31.7 (iOS), and 2026.8.2115.0 on Windows, macOS and Linux
- Cloudflare Tunnel (cloudflared): 2026.10.2; container deployments need the fixed image updated and redeployed
Cloudflare says users of Cloudflare Zero Trust with Gateway on an up-to-date client are automatically protected.
What else customers may need to change
Some customers will have to act on software or trust configurations they run themselves, especially on origin servers. Cloudflare asks those using customer-configured TLS client authentication to review and update their mutual TLS trust store and uploaded CAs used to verify client certificates.
It also asks customers to review custom origin certificates and server configurations if they use Full (strict) or Strict encryption mode. Cloudflare says it is updating Automatic SSL/TLS to notify customers who still use the distrusted certificates, which would cause breakages.
Cloudflare Containers and Sandboxes users should check their container images and application dependencies for affected certificate trust stores and apply updates based on the deployed image. Customers can also enable HTTPS egress interception to route outbound HTTPS requests through Cloudflare, moving remote-server certificate validation to Cloudflare-managed infrastructure; containers with it enabled are already protected.
Cloudflare says teams are still working on further remediation and that much work remains. The client and cloudflared updates are available now through the usual channels, and the version numbers above are the ones to check for.
Related reading
Sources
- 8 eMudhra certificates are compromised. Here's what you need to know — Cloudflare Blog
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
