Package vulnerability, severity medium
Compromised eMudhra CA keys: certifi, grpc, httplib2, google-api-client and runtimes need trust store updates
Published
Private keys for eight eMudhra (emSign) subordinate CA certificates were generated with insufficient randomness and can be recovered, so an attacker on the network path could forge TLS certificates for any domain. Applications built with Google Cloud SDK Libraries are affected if their trust store still accepts the emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services roots. The fix is to update the packages, runtimes and trust stores that supply the root store, then rebuild and redeploy.
What's affected
- certifi (pypi)<2026.10.19
- httplib2 (pypi)<0.32.1
- grpcio (pypi)<1.84.1
- com.google.api-client:google-api-client (maven)<2.9.2
- grpc (rubygems)<1.84.1
- grpc/grpc (packagist)<1.84.1
- grpc (npm)every version
- Grpc.Core (nuget)every version
- rustls-webpki (cargo)<0.103.16
- webpki-root-certs (cargo)<1.0.10
- webpki-roots (cargo)<1.0.10
- node runtime>=26.0.0 <26.12.1; >=24.0.0 <24.22.1; >=22.0.0 <22.23.4
- go runtime<1.26.10; >=1.27.0 <1.27.3
What to do
- Upgrade certifi, httplib2, grpcio, grpc (Ruby), grpc/grpc (PHP), google-api-client (Java) and the Rust webpki crates to the fixed versions, then rebuild and redeploy container images.
- Upgrade Node.js to 26.12.1, 24.22.1, 22.23.4 or later, and rebuild Go binaries and images with Go 1.26.10, 1.27.3 or later.
- Migrate off the deprecated grpc npm package to @grpc/grpc-js, and off the legacy Grpc.Core package to Grpc.Net.Client.
- Update the operating system, JDK and container base image trust stores, including the Windows root certificate update.
- Verify that the emSign ECC Root CA - G3, emSign Root TLS CA - G3 and AAA Certificate Services roots are absent from the trust store your application uses.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident google-cloud-sdk-emudhra-ca-trust-2026-11References
Notice google-cloud-sdk-emudhra-ca-trust-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.