Cloud service vulnerability, severity medium
Google Cloud: compromised eMudhra CA keys require trust store updates on GKE and Cloud Run
Published , updated
Private keys for eight eMudhra (emSign) subordinate CA certificates were generated with weak entropy, letting a remote attacker reconstruct them, forge trusted TLS certificates and perform man-in-the-middle attacks. Google says its infrastructure was not breached and shows no evidence of exploitation, but customer-managed operating systems and custom container images on GKE and Cloud Run must remove trust in the affected CAs.
What's affected
- gcp gke kubernetesevery version
- gcp runevery version
What to do
- Update the trust store through your operating system vendor to revoke trust in the compromised eMudhra (emSign) and AAA Certificate Services certificates, including in custom container images.
- On Container-Optimized OS, upgrade or restart nodes to pick up current milestone releases, or apply the CA certificate mitigation tool.
- Update the Google Cloud CLI to the latest release so bundled dependencies include updated certificate stores.
- For GKE, check the GKE security bulletin for patch versions.
- Review service documentation for managed services as Google rolls out updates.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident gcp-emudhra-ca-compromise-2026-10References
Notice gcp-emudhra-ca-compromise-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.