GVD-2026-0001 · Third Party advisory
Compromised eMudhra intermediate CAs in Go crypto/x509
What you need to do
Self-Hosted
Install your operating system’s CA certificate updates on every host that runs Gravwell services or ingesters, then restart those services.
Upgrade to Gravwell 5.10.3.
For Docker deployments, pull the 5.10.3 gravwell images.
Gravwell Cloud
No action required.
Vulnerabilities
| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-111943 | Critical | 9.1 | CWE-295 | Fixed | 5.10.3 |
CVE-2026-111943crypto/x509 accepts chains through compromised eMudhra intermediates
- Aliases
- GO-2026-6809
- Component
- All Gravwell services and ingesters that verify the TLS certificates of servers they connect to
- Status
- Fixed
- Affected versions
- < 5.10.3
- Fixed in
- 5.10.3
- CWE
- CWE-295: Improper Certificate Validation
Scores Gravwell's assessment
- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The private keys of eight eMudhra intermediate CA certificates were compromised. Certificates issued with
those keys chain to roots that operating systems trust, so a program that relies on an unpatched trust store
accepts them. Go 1.26.10 and 1.27.3 add a denylist to crypto/x509 so that Certificate.Verify rejects any
chain through the compromised intermediates, whatever the system trust store contains.
An attacker who holds one of the keys and can intercept a Gravwell component’s outbound TLS connection can impersonate the server it connects to, reading and altering the traffic, including any credentials it carries.
Upstream references
Summary
In October 2026 a researcher showed that the private keys for eight eMudhra intermediate certificate authorities, six for TLS and two for code signing, had been compromised. Anyone holding those keys can issue certificates that most operating systems trust.
Every Gravwell service and ingester that makes outbound TLS connections, for example to cloud APIs, identity
providers or remote indexers, verifies the server’s certificate with Go’s crypto/x509. Gravwell releases before
5.10.3 accept certificates issued through the compromised intermediates wherever the host’s or container’s trust
store hasn’t been updated. An attacker needs one of the compromised keys and a way to intercept the connection.
Gravwell 5.10.3 is built with Go 1.26.10, which rejects these intermediates regardless of the trust store.
Mitigations
Gravwell components built with Go releases before 1.26.10 rely on the system trust store. Until you can upgrade, update it on each host and restart the services to block the compromised intermediates. On Debian and Ubuntu:
sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates
sudo systemctl restart 'gravwell_*'This doesn’t protect Docker deployments: their images carry their own certificate bundle.
References
Changelog
- Initial publication.