Go Blocks Compromised eMudhra Certificate Authorities in CVE-2026-111943
Summary
After eight eMudhra intermediate CA private keys were compromised, Go added certificate-chain blocking in versions 1.26.10 and 1.27.3. Organizations should update and rebuild affected applications and check independent trust stores.
Key points
- Eight eMudhra intermediate CA private keys were compromised: six used for TLS and two for code signing.
- Mozilla confirmed the compromise and independently recovered the affected private keys; the article reports no evidence of widespread fraudulent TLS certificate abuse before browser blocks.
- Go 1.26.10 and 1.27.3 add a crypto/x509 denylist that rejects chains containing the compromised intermediate keys.
- Affected Go versions are earlier than 1.26.10 and, on the Go 1.27 branch, earlier than 1.27.3. Applications built with affected versions need to be rebuilt with a patched release.
- Chrome and Firefox deployed blocks for the affected TLS intermediates; other ecosystem updates included Mozilla NSS, Python certifi, and Rust webpki-roots.
- Organizations should update independent CA bundles, identify embedded or static trust stores, and inspect TLS telemetry for affected certificate chains.
- Trust-store changes can disrupt legitimate services that depend on affected chains, so organizations should identify dependencies and replace certificates where needed.
Article Details
- Vulnerability Types
- Compromise of intermediate certificate authority private keys due to a flawed key-generation process
- Certificate validation that continued to trust chains containing compromised intermediates
- Affected Versions
- Go standard library versions before 1.26.10
- Go 1.27 branch versions before 1.27.3
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update certificate stores and language-specific trust bundles, and block or distrust the eight compromised intermediate certificate keys.
CVE
People
Vendors
eMudhraPrivate keys associated with eight eMudhra intermediate certificate authority certificates were compromised, potentially allowing unauthorized parties to create certificates that could appear trustworthy to vulnerableGo ProjectThe Go Project responded by introducing CVE-2026-111943, which addresses cases where Go applications could continue trusting certificate chains containing the compromised intermediates.MozillaMozilla subsequently confirmed the compromise and, importantly, reported that its engineers were able to independently recover the affected private keys without receiving details about the researcher’s method.
Products
certifiGo added explicit blocking, Mozilla updated NSS, Python’s certifi certificate bundle removed the affected root, and the Rust webpki-roots ecosystem issued an update.GoThe Go Project responded by introducing CVE-2026-111943, which addresses cases where Go applications could continue trusting certificate chains containing the compromised intermediates.Mozilla FirefoxMozilla received the report later that evening and distributed a OneCRL block to standard Firefox configurations by 22:59 UTC.NSSGo added explicit blocking, Mozilla updated NSS, Python’s certifi certificate bundle removed the affected root, and the Rust webpki-roots ecosystem issued an update.webpki-rootsGo added explicit blocking, Mozilla updated NSS, Python’s certifi certificate bundle removed the affected root, and the Rust webpki-roots ecosystem issued an update.