Sonatype Details Product Impact From eMudhra CA Key-Generation Flaw
Summary
A researcher reported that weak randomness made eight eMudhra intermediate CA private keys recoverable, potentially enabling trusted TLS certificates. Sonatype is updating affected products and urges customers to update trust stores and follow vendor guidance.
Key points
- On October 17, 2026, a researcher reported that insufficient randomness could allow recovery of private keys for eight eMudhra intermediate CAs: six for TLS and two for code signing.
- A recovered TLS key could enable creation of a certificate accepted by clients that still trust the affected chain; browser and operating-system vendors have taken steps to block the certificates.
- Sonatype is preparing updated Docker images and patch releases. Self-hosted Nexus Repository versions released before October 21, 2026, and IQ Server version 208 and earlier are listed as in progress for remediation.
- Sonatype lists remediation as complete for its affected cloud Nexus Repository, IQ Server, and Guide offerings.
- Customers are advised to update browsers, operating systems, and software with bundled trust stores, including containers and applications; customers using eMudhra-issued certificates should check with their certificate provider.
- Sonatype says not to bypass certificate validation warnings or manually change a product's bundled JVM trust store without product-specific instructions. The article also cites CVE-2026-111943, CVE-2026-113470, and RHSB-2026-012.
Article Details
- Vulnerability Types
- Insufficient randomness in the generation of private keys for intermediate certificate authorities, allowing the keys to be recovered.
- Affected Versions
- Sonatype Nexus Repository: all versions released prior to 2026-10-21
- Sonatype IQ Server: version 208 and earlier
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Update certificate trust stores in browsers, operating systems, and software that bundles a trust store, including containers and applications.
- For systems using eMudhra-issued certificates, contact the certificate provider to confirm whether the chain is affected and whether replacement or another action is needed.
CVE
Vendors
eMudhraSonatype is responding to the industry-wide eMudhra certificate authority incident, which affects certificate trust stores used by certain Sonatype products and distributions.SonatypeSonatype is responding to the industry-wide eMudhra certificate authority incident, which affects certificate trust stores used by certain Sonatype products and distributions.