SecOraLens
CriticalCVE

8 eMudhra certificates are compromised. Here's what you need to know

Cloudflare Blog·Source published ·1 min read

What happened?

On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. This is a serious security incident with implications across the Internet.

Key details

  • Eight eMudhra intermediate certificate private keys were compromised, enabling forged certificates for any domain.
  • Attackers can impersonate servers to intercept or modify traffic using the weak keys.
  • Cloudflare found no active exploitation of the issue on its services.
  • Updates released for Cloudflare One Clients, 1.1.1.1 app, and Cloudflare Tunnel with mitigations deployed across CDN and Zero Trust products.

Affected

  • Eight eMudhra intermediate certificates widely trusted by browsers, operating systems, and Cloudflare.
  • Cloudflare One Client, WARP, 1.1.1.1 app, Cloudflare Tunnel (cloudflared), Cloudflare Zero Trust, CDN, Developer, and Zero Trust products.
  • Customer origin servers using Full (strict) or Strict encryption mode with custom certificates.
  • Cloudflare Containers and Sandboxes with affected certificate trust stores in container images.

Fixes and mitigations

  1. Upgrade Cloudflare One Client to v2.5.6 (Android), v1.12.16 (iOS), Windows/macOS/Linux 2026.8.2115.0.
  2. Upgrade 1.1.1.1 app to v6.38.10 (Android), v6.31.7 (iOS), Windows/macOS/Linux 2026.8.2115.0.
  3. Upgrade Cloudflare Tunnel (cloudflared) to 2026.10.2 and redeploy fixed container images.
  4. Review and update mutual TLS trust stores and uploaded CAs for client certificate verification.
  5. Enable HTTPS egress interception to route outbound HTTPS through Cloudflare for managed trust-store protection.
  6. Apply dependency updates from Dennis Jackson's crowdsourced list, rebuild images, and restart or redeploy applications.

Summarised by SecOraLens from Cloudflare Blog. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories