Eight eMudhra intermediate certificate keys compromised, Cloudflare says
Original title: 8 eMudhra certificates are compromised. Here's what you need to know
Cloudflare says it has not seen exploitation on its services and has shipped client and tunnel updates.
Cloudflare said that on October 19 it learned private keys for eight widely trusted eMudhra intermediate certificates were compromised. Because the keys are weak, an attacker can forge a certificate for any domain and impersonate servers to intercept or modify traffic. Cloudflare has updated Cloudflare One clients, the 1.1.1.1 app and cloudflared, and deployed CDN and Zero Trust mitigations. It says its review has not identified active exploitation on Cloudflare services.
Unconfirmed: Cloudflare reports no exploitation on its services; whether the keys have been used elsewhere is not confirmed in this post.
- Cloudflare learned of the compromise around 17:00 UTC on October 19.
- Cloudflare One Client updates include v2.5.6 on Android and 2026.8.2115.0 on desktop.
- The 1.1.1.1 app updates include v6.38.10 on Android and v6.31.7 on iOS.
- cloudflared should be upgraded to 2026.10.2 and container images redeployed.
- CDN and server-side Zero Trust mitigations were fully deployed at 19:20 UTC on October 20.
Impact: Forged certificates can impersonate any domain and alter traffic
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra intermediate certificates | eight compromised certificates | — |
| Cloudflare One Client | — | v2.5.6 (Android); Windows, macOS and Linux 2026.8.2115.0 |
| Cloudflare 1.1.1.1 app | — | v6.38.10 (Android); v6.31.7 (iOS); desktop 2026.8.2115.0 |
| cloudflared | — | 2026.10.2 |
- 1.Upgrade Cloudflare One and 1.1.1.1 clients to the versions Cloudflare lists.
- 2.Upgrade cloudflared to 2026.10.2 and redeploy fixed container images.
- 3.Review mutual TLS trust stores and origin certificates used in strict TLS modes.
- Vendors
- eMudhraCloudflare
- Organizations
- Mozilla
From the original article
4 min read at blog.cloudflare.com
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.
By Christopher Patton · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.