certifi bundles emSign root CAs with compromised intermediate CA keys

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

PYSEC-2026-4320 certifi bundles emSign root CAs with compromised intermediate CA keys

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

GHSA-6Q48-6C7W-9GW2 certifi bundles emSign root CAs with compromised intermediate CA keys

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

certifi bundles emSign root CAs with compromised intermediate CA keys

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue...

emudhra-poc

eMudhra CA Key Compromise Proof-of-Concept In October 2026, e...

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued...

PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the ResourceService process. An attacker can gain unauthorized access to sensitive cluster CA private keys by reading the ImportedClusterSecrets resource. This allows the attacker...

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Summary Omni supports importing standalone Talos clusters. During this process, an ImportedClusterSecrets resource is created, which contains the full CA secrets bundle for the cluster being imported. If these secrets are not rotated by the importing actor, an authenticated Omni user with Reader...

Pulp Insecure Creation of CA Keys Vulnerability

Pulp is a free and open source repository platform for managing content. The platform supports pushing content from software packages to consumers. A security vulnerability exists in Pulp versions prior to 2.3.0, which stems from the creation of CA certificates and keys in the /tmp/$RANDOM...