# GVD-2026-0001: Compromised eMudhra intermediate CAs in Go crypto/x509

| | |
|---|---|
| Advisory | GVD-2026-0001 |
| Kind | Third Party |
| Severity | Critical |
| Published | 2026-10-29 |
| Last updated | 2026-10-29 |
| Fixed in | 5.10.3 |
| CSAF | https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0001.json |
| Web page | https://security.gravwell.io/advisories/GVD-2026-0001/ |

## What you need to do

### Self-Hosted

Install your operating system's CA certificate updates on every host that runs Gravwell
services or ingesters, then restart those services.
    
Upgrade to [Gravwell 5.10.3](https://docs.gravwell.io/changelog/5.10.3.html).

For Docker deployments, pull the 5.10.3 gravwell images.

### Gravwell Cloud

No action required.

## Vulnerabilities

| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-111943 | Critical | 9.1 | CWE-295 | Fixed | 5.10.3 |

### CVE-2026-111943: crypto/x509 accepts chains through compromised eMudhra intermediates

- Aliases: GO-2026-6809
- Component: All Gravwell services and ingesters that verify the TLS certificates of servers they connect to
- Status: Fixed
- Affected versions: < 5.10.3
- Fixed in: 5.10.3
- CWE: CWE-295: Improper Certificate Validation
- CVSS 4.0 (Gravwell's assessment): 9.1 Critical, `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
- CVSS 3.1 (Gravwell's assessment): 7.4 High, `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`

The private keys of eight eMudhra intermediate CA certificates were compromised. Certificates issued with
those keys chain to roots that operating systems trust, so a program that relies on an unpatched trust store
accepts them. Go 1.26.10 and 1.27.3 add a denylist to `crypto/x509` so that `Certificate.Verify` rejects any
chain through the compromised intermediates, whatever the system trust store contains.

An attacker who holds one of the keys and can intercept a Gravwell component's outbound TLS connection can
impersonate the server it connects to, reading and altering the traffic, including any credentials it carries.

Upstream references:

- [Go Issue #82345](https://go.dev/issue/82345)
- [Go vulnerability GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)
- [emudhra.we-have-a-problem.com](https://emudhra.we-have-a-problem.com)

## Summary

In October 2026 a researcher showed that the private keys for eight eMudhra intermediate certificate authorities, six
for TLS and two for code signing, had been compromised. Anyone holding those keys can issue certificates that most
operating systems trust.

Every Gravwell service and ingester that makes outbound TLS connections, for example to cloud APIs, identity
providers or remote indexers, verifies the server's certificate with Go's `crypto/x509`. Gravwell releases before
5.10.3 accept certificates issued through the compromised intermediates wherever the host's or container's trust
store hasn't been updated. An attacker needs one of the compromised keys and a way to intercept the connection.

[Gravwell 5.10.3](https://docs.gravwell.io/changelog/5.10.3.html) is built with Go 1.26.10, which rejects these
intermediates regardless of the trust store.

## Mitigations

Gravwell components built with Go releases before 1.26.10 rely on the system trust store. Until you can upgrade,
update it on each host and restart the services to block the compromised intermediates. On Debian and Ubuntu:

```
sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates
sudo systemctl restart 'gravwell_*'
```

This doesn't protect Docker deployments: their images carry their own certificate bundle.

## References

- [eMudhra intermediate CA compromise tracker](https://emudhra.we-have-a-problem.com/)
- [Debian security tracker: CVE-2026-111943](https://security-tracker.debian.org/tracker/CVE-2026-111943)

## Changelog

- 2026-10-29: Initial publication.

Questions this advisory doesn't answer? Email the Gravwell Security Team at security@gravwell.io.