GSA-2026-0001 · Third Party advisory
Compromised eMudhra intermediate CAs in Go crypto/x509
What you need to do
Self-Hosted
Install your operating system’s CA certificate updates on every host that runs Gravwell services or ingesters, then restart those services.
Upgrade to Gravwell 5.10.3.
For Docker deployments, pull the 5.10.3 gravwell images.
Gravwell Cloud
No action required in the Gravwell Cloud console.
If you run edge-deployed ingesters or federators, upgrade them to 5.10.3.
Vulnerabilities
| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-111943 | Critical | 9.1 | CWE-295 | Fixed | 5.10.3 |
CVE-2026-111943crypto/x509 accepts chains through compromised eMudhra intermediates
- Aliases
- GO-2026-6809
- Component
- All Gravwell services and ingesters that verify the TLS certificates of servers they connect to
- Status
- Fixed
- Affected versions
- < 5.10.3
- Fixed in
- 5.10.3
- CWE
- CWE-295: Improper Certificate Validation
Scores Gravwell's assessment
- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The private keys of eight eMudhra intermediate CA certificates were compromised. Certificates issued with
those keys chain to roots that operating systems trust, so a program that relies on an unpatched trust store
accepts them. Go 1.26.10 and 1.27.3 add a denylist to crypto/x509 so that Certificate.Verify rejects any
chain through the compromised intermediates, whatever the system trust store contains.
An attacker needs one of the keys and a position on the network path of an outbound TLS connection from a Gravwell component. That attacker can impersonate the server at the other end. The attacker can then read and change the traffic, including any credentials that it carries.
Upstream references
Summary
In October 2026, a researcher showed that the private keys of eight eMudhra intermediate certificate authorities were compromised. Six of them are for TLS and two are for code signing. Anyone who holds those keys can issue certificates that most operating systems trust.
When a Gravwell service or ingester makes an outbound TLS connection, it verifies the server certificate with Go’s
crypto/x509. Examples are connections to cloud APIs, identity providers or remote indexers. If the trust store of the
host or container is not updated, Gravwell releases before 5.10.3 accept certificates issued through the compromised
intermediates. An attacker needs one of the compromised keys and a way to intercept the connection.
Gravwell 5.10.3, released on 2026-10-29, is built with Go 1.26.10, which rejects these intermediates regardless of the trust store.
Mitigations
Gravwell components built with Go releases before 1.26.10 rely on the system trust store. Until you can upgrade, update it on each host and restart the services to block the compromised intermediates. On Debian and Ubuntu:
sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates
sudo systemctl restart 'gravwell_*'This step does not protect Docker deployments, because their images carry their own certificate bundle.
References
Changelog
- Added the 5.10.3 release date. Added a link to the Go security announcement. Made the text easier to read.
- Added guidance for customers running edge-deployed ingesters or federators.
- Initial publication.