Cloudflare Details Response to Compromise of Eight eMudhra Certificates

Summary

Cloudflare says keys for eight eMudhra intermediate certificates were compromised, enabling forged certificates and server impersonation. It patched services, updated WARP and cloudflared, and advises customers to update software and review trust stores.

Key points

Cloudflare says private keys associated with eight eMudhra intermediate certificates were compromised.
The article says the weak keys could allow forged certificates for any domain, enabling server impersonation and traffic interception or modification.
Cloudflare says its security review found no active exploitation of the issue on its services.
Cloudflare released updates for Cloudflare One/WARP and Cloudflare Tunnel; the stated cloudflared update is version 2026.10.2.
Cloudflare says it deployed mitigations across its CDN, Developer, and Zero Trust products.
Customers are advised to update affected software, review custom TLS trust stores and origin-server configurations, and check container images and dependencies.
Cloudflare warns developers not to disable certificate verification to resolve certificate errors, and advises testing through each application’s actual TLS verification path.

Article Details

Event Type: Compromise of private keys associated with eight eMudhra intermediate certificates.
Impact: Because the keys are weak, an attacker could create forged certificates for any domain and use them to impersonate servers and intercept or modify traffic. The certificates were widely trusted, including within Cloudflare. Cloudflare reported that its security review had not identified active exploitation on its services; it deployed mitigations and issued updates, while some customers still need to update software or trust configurations.

People

Dennis JacksonIdentified as Mozilla’s Dennis Jackson; his crowdsourced list covers commonly used packages that have been patched, and his test site provides browser checks, testing instructions, and package update information.

Vendors

CloudflareOn October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers,eMudhra19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating

Products

1.1.1.1 appWe have released updates for the Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. We have also deployed mitigations across our CDN, Developer, and Zero Cloudflare One ClientsWe have released updates for the Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. We have also deployed mitigations across our CDN, Developer, and Zero Cloudflare TunnelWe have released updates for the Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. We have also deployed mitigations across our CDN, Developer, and Zero Cloudflare WARPWe have released updates for the Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. We have also deployed mitigations across our CDN, Developer, and Zero Cloudflare Zero Trustalso deployed mitigations across our CDN, Developer, and Zero Trust products. If you are using Cloudflare Zero Trust with Gateway and an up-to-date client (see below), you are automatically protected.