Eight eMudhra Certificates Compromised: Action Required for Admins
Private keys for eight eMudhra intermediate certificates were compromised, allowing potential traffic interception. Learn what systems are affected and how to patch.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Overview of the eMudhra Certificate Compromise
On October 19, 2026, private keys associated with eight eMudhra intermediate certificates were discovered to be compromised. Because these certificates are widely trusted by operating systems, browsers, and infrastructure tools, attackers could potentially forge certificates for any domain to impersonate servers and intercept traffic.
Cloudflare confirmed the incident and has already deployed server-side mitigations across its CDN, Developer, and Zero Trust products. However, administrators, developers, and self-hosters managing client software, tunnels, or origin servers must take manual action to secure their environments.
Required Actions for Software and Client Deployments
Users running specific Cloudflare tools and self-hosted components must update immediately to mitigate vulnerability risks:
- Cloudflare One / WARP: Upgrade the Cloudflare One Client to version v2.5.6 on Android, v1.12.16 on iOS, or version 2026.8.2115.0 on Windows, macOS, and Linux. For the 1.1.1.1 app, upgrade to version v6.38.10 on Android, v6.31.7 on iOS, or version 2026.8.2115.0 on desktop and Linux.
- Cloudflare Tunnel (cloudflared): Update to version 2026.10.2. Container deployments must update and redeploy the fixed image.
- Customer Origin Servers: Review custom origin certificates and server configurations if utilizing Full (strict) or Strict encryption modes. Automatic SSL/TLS updates will help notify users of distrusted configurations.
- Containers and Sandboxes: Review container images and application dependencies for affected trust stores. Enabling HTTPS egress interception routes outbound requests through Cloudflare-managed infrastructure, providing automatic protection.
Developer Guidance and Dependency Management
Developers must look beyond basic SDK updates. Because API clients often delegate certificate verification to language runtimes, HTTP libraries, or the underlying operating system, updating an SDK alone may not alter the active trust policy.
Administrators should consult crowdsourced dependency lists to find affected third-party software packages, apply updates, rebuild images, and restart applications. When troubleshooting post-update certificate errors in dashboards, never disable verification, as doing so permanently removes essential authentication protections.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
