{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "In October 2026 a researcher showed that the private keys for eight eMudhra intermediate certificate authorities, six for TLS and two for code signing, had been compromised. Anyone holding those keys can issue certificates that most operating systems trust.\n\nEvery Gravwell service and ingester that makes outbound TLS connections, for example to cloud APIs, identity providers or remote indexers, verifies the server's certificate with Go's crypto/x509. Gravwell releases before 5.10.3 accept certificates issued through the compromised intermediates wherever the host's or container's trust store hasn't been updated. An attacker needs one of the compromised keys and a way to intercept the connection.\n\nGravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html) is built with Go 1.26.10, which rejects these intermediates regardless of the trust store.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Install your operating system's CA certificate updates on every host that runs Gravwell services or ingesters, then restart those services.\n\nUpgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.",
        "title": "Self-Hosted"
      },
      {
        "category": "general",
        "text": "No action required.",
        "title": "Gravwell Cloud"
      },
      {
        "category": "legal_disclaimer",
        "text": "This advisory is provided as is. Scores are Gravwell's assessment of each vulnerability as it affects Gravwell.",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@gravwell.io",
      "name": "Gravwell",
      "namespace": "https://gravwell.io"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0001.json"
      },
      {
        "category": "self",
        "summary": "Human-readable advisory",
        "url": "https://security.gravwell.io/advisories/GVD-2026-0001/"
      },
      {
        "category": "external",
        "summary": "eMudhra intermediate CA compromise tracker",
        "url": "https://emudhra.we-have-a-problem.com/"
      },
      {
        "category": "external",
        "summary": "Debian security tracker: CVE-2026-111943",
        "url": "https://security-tracker.debian.org/tracker/CVE-2026-111943"
      }
    ],
    "title": "Compromised eMudhra intermediate CAs in Go crypto/x509",
    "tracking": {
      "current_release_date": "2026-10-29T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "gvd"
        }
      },
      "id": "GVD-2026-0001",
      "initial_release_date": "2026-10-29T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-29T00:00:00.000Z",
          "number": "1",
          "summary": "Initial publication."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/>=5.10.3",
                "product": {
                  "name": "Gravwell >= 5.10.3",
                  "product_id": "GRAVWELL-GE-5.10.3"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/<5.10.3",
                "product": {
                  "name": "Gravwell < 5.10.3",
                  "product_id": "GRAVWELL-LT-5.10.3"
                }
              }
            ],
            "category": "product_name",
            "name": "Gravwell"
          }
        ],
        "category": "vendor",
        "name": "Gravwell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "ids": [
        {
          "system_name": "Go Vulnerability Database",
          "text": "GO-2026-6809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The private keys of eight eMudhra intermediate CA certificates were compromised. Certificates issued with those keys chain to roots that operating systems trust, so a program that relies on an unpatched trust store accepts them. Go 1.26.10 and 1.27.3 add a denylist to crypto/x509 so that Certificate.Verify rejects any chain through the compromised intermediates, whatever the system trust store contains.\n\nAn attacker who holds one of the keys and can intercept a Gravwell component's outbound TLS connection can impersonate the server it connects to, reading and altering the traffic, including any credentials it carries.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "All Gravwell services and ingesters that verify the TLS certificates of servers they connect to",
          "title": "Affected component"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 9.1 (Critical), CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "fixed": [
          "GRAVWELL-GE-5.10.3"
        ],
        "known_affected": [
          "GRAVWELL-LT-5.10.3"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Go Issue #82345",
          "url": "https://go.dev/issue/82345"
        },
        {
          "category": "external",
          "summary": "Go vulnerability GO-2026-6809",
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        },
        {
          "category": "external",
          "summary": "emudhra.we-have-a-problem.com",
          "url": "https://emudhra.we-have-a-problem.com"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install your operating system's CA certificate updates on every host that runs Gravwell services or ingesters, then restart those services.\n\nUpgrade to Gravwell 5.10.3 (https://docs.gravwell.io/changelog/5.10.3.html).\n\nFor Docker deployments, pull the 5.10.3 gravwell images.",
          "product_ids": [
            "GRAVWELL-LT-5.10.3"
          ],
          "url": "https://security.gravwell.io/advisories/GVD-2026-0001/"
        },
        {
          "category": "mitigation",
          "details": "Gravwell components built with Go releases before 1.26.10 rely on the system trust store. Until you can upgrade, update it on each host and restart the services to block the compromised intermediates. On Debian and Ubuntu:\n\nsudo apt-get update\nsudo apt-get install --only-upgrade ca-certificates\nsudo systemctl restart 'gravwell_*'\n\nThis doesn't protect Docker deployments: their images carry their own certificate bundle.",
          "product_ids": [
            "GRAVWELL-LT-5.10.3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-LT-5.10.3"
          ]
        }
      ],
      "title": "crypto/x509 accepts chains through compromised eMudhra intermediates"
    }
  ]
}