eMudhra Intermediate Certificate Authority Compromise (CVE-2026-111943)

On October 17, 2026, a security researcher identified that eight intermediate certificate authorities operated by eMudhra possessed insecurely generated private keys, which could be independently recovered. This compromise allows an attacker to issue fraudulent, trusted TLS and code-signing certificates. While there is no evidence of widespread abuse prior to defensive actions, the severity of the cryptographic failure prompted immediate revocation and denylisting efforts across browsers and language runtimes. The Go Project released CVE-2026-111943 to hardcode a denylist of the affected keys in the crypto/x509 library to protect applications that do not rely on system-level certificate revocation mechanisms.

Impact

An attacker in possession of the compromised intermediate keys could potentially impersonate legitimate websites, intercept encrypted traffic, or sign malicious code. The risk is highest for applications that manage independent certificate bundles or runtimes that do not consume browser-based revocation lists like CRLSet or OneCRL.

Recommendation

• Upgrade Go environments to version 1.26.10, 1.27.3, or later and rebuild all compiled applications to incorporate the new cryptographic denylist.
• Update Firefox to version 158.0.1, ESR 115.43.1, or ESR 153.5.1 and ensure NSS is patched to 3.131.1 or later.
• Audit and update software dependencies that maintain embedded certificate bundles, specifically Python's 'certifi' and Rust's 'webpki-roots' (ensure version 1.0.10 or newer).
• Monitor certificate chain telemetry for the presence of the eight identified compromised intermediate CA public keys.