# GSA-2026-0001: Compromised eMudhra intermediate CAs in Go crypto/x509

| | |
|---|---|
| Advisory | GSA-2026-0001 |
| Kind | Third Party |
| Severity | Critical |
| Published | 2026-10-29 |
| Last updated | 2026-11-02 |
| Fixed in | 5.10.3 |
| CSAF | https://security.gravwell.io/.well-known/csaf/white/2026/gsa-2026-0001.json |
| Web page | https://security.gravwell.io/advisories/GSA-2026-0001/ |

## What you need to do

### Self-Hosted

Install your operating system's CA certificate updates on every host that runs Gravwell
services or ingesters, then restart those services.
    
Upgrade to [Gravwell 5.10.3](https://docs.gravwell.io/changelog/5.10.3.html).

For Docker deployments, pull the 5.10.3 gravwell images.

### Gravwell Cloud

No action required in the Gravwell Cloud console.

If you run edge-deployed ingesters or federators, upgrade them to 5.10.3.

## Vulnerabilities

| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-111943 | Critical | 9.1 | CWE-295 | Fixed | 5.10.3 |

### CVE-2026-111943: crypto/x509 accepts chains through compromised eMudhra intermediates

- Aliases: GO-2026-6809
- Component: All Gravwell services and ingesters that verify the TLS certificates of servers they connect to
- Status: Fixed
- Affected versions: < 5.10.3
- Fixed in: 5.10.3
- CWE: CWE-295: Improper Certificate Validation
- CVSS 4.0 (Gravwell's assessment): 9.1 Critical, `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
- CVSS 3.1 (Gravwell's assessment): 7.4 High, `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

The private keys of eight eMudhra intermediate CA certificates were compromised. Certificates issued with
those keys chain to roots that operating systems trust, so a program that relies on an unpatched trust store
accepts them. Go 1.26.10 and 1.27.3 add a denylist to `crypto/x509` so that `Certificate.Verify` rejects any
chain through the compromised intermediates, whatever the system trust store contains.

An attacker needs one of the keys and a position on the network path of an outbound TLS connection from a
Gravwell component. That attacker can impersonate the server at the other end. The attacker can then read and
change the traffic, including any credentials that it carries.

Upstream references:

- [Go Issue #82345](https://go.dev/issue/82345)
- [golang-announce: Go 1.27.3 and Go 1.26.10 security release](https://groups.google.com/g/golang-announce/c/66pojueaQek)
- [Go vulnerability GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)
- [emudhra.we-have-a-problem.com](https://emudhra.we-have-a-problem.com)

## Summary

In October 2026, a researcher showed that the private keys of eight eMudhra intermediate certificate authorities were
compromised. Six of them are for TLS and two are for code signing. Anyone who holds those keys can issue certificates
that most operating systems trust.

When a Gravwell service or ingester makes an outbound TLS connection, it verifies the server certificate with Go's
`crypto/x509`. Examples are connections to cloud APIs, identity providers or remote indexers. If the trust store of the
host or container is not updated, Gravwell releases before 5.10.3 accept certificates issued through the compromised
intermediates. An attacker needs one of the compromised keys and a way to intercept the connection.

[Gravwell 5.10.3](https://docs.gravwell.io/changelog/5.10.3.html), released on 2026-10-29, is built with Go 1.26.10,
which rejects these intermediates regardless of the trust store.

## Mitigations

Gravwell components built with Go releases before 1.26.10 rely on the system trust store. Until you can upgrade,
update it on each host and restart the services to block the compromised intermediates. On Debian and Ubuntu:

```
sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates
sudo systemctl restart 'gravwell_*'
```

This step does not protect Docker deployments, because their images carry their own certificate bundle.

## References

- [eMudhra intermediate CA compromise tracker](https://emudhra.we-have-a-problem.com/)
- [Debian security tracker: CVE-2026-111943](https://security-tracker.debian.org/tracker/CVE-2026-111943)

## Changelog

- 2026-11-02: Added the 5.10.3 release date. Added a link to the Go security announcement. Made the text easier to read.
- 2026-10-30: Added guidance for customers running edge-deployed ingesters or federators.
- 2026-10-29: Initial publication.

Questions this advisory doesn't answer? Email the Gravwell Security Team at security@gravwell.io.