JA EN
shiichan

8 eMudhra Certificates Compromised: Update WARP and cloudflared Now

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#web

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

This is an important one about the foundations of Internet trust. Let's go through it carefully!

What was announced?

The Cloudflare blog reported that the private keys for eight eMudhra intermediate certificates were compromised. Cloudflare learned of it at about 17:00 UTC on October 19, 2026. These certificates were widely trusted by browsers, operating systems, and Cloudflare's own systems.

Why it matters

Because the keys are weak, an attacker could forge a certificate for any domain and impersonate servers, which could allow traffic to be intercepted or altered.

The flaw is in certificate-based authentication, not in TLS's encryption algorithms. Many software stacks depend on the WebPKI for authentication, so the impact spans the Internet.

Cloudflare's security review found no active exploitation of this issue on its services.

What changes

Browser makers can push fixes centrally, but many organizations must update hundreds of applications, libraries, and images, so the impact is uneven.

Cloudflare's response:

  • Patched critical services before public disclosure
  • Released client updates for Cloudflare One Client (WARP), the 1.1.1.1 app, and Cloudflare Tunnel (cloudflared)
  • Deployed server-side mitigations across the CDN, Developer, and Zero Trust products
  • Zero Trust customers with Gateway and an up-to-date client are protected automatically

Dive Deep

What customers need to do, by product:

  • Cloudflare One / WARP: upgrade to Android 2.5.6, iOS 1.12.16, or desktop 2026.8.2115.0
  • 1.1.1.1 app: upgrade to Android 6.38.10, iOS 6.31.7, or desktop 2026.8.2115.0
  • cloudflared (Tunnel): upgrade to 2026.10.2; for containers, redeploy the fixed image
  • Mutual TLS (client certificate verification): review and update the trust store or uploaded CAs
  • Origin servers (Full (strict) or Strict modes): review custom origin certificates and server configurations; Cloudflare is adding automatic notifications for customers still using distrusted certificates
  • Cloudflare Containers (including Sandboxes): review images and dependencies for affected trust stores and update them, or enable HTTPS egress interception so Cloudflare-managed infrastructure validates remote certificates (containers with it enabled are already protected)

Guidance for developers:

  • An SDK update alone may not be enough; certificate checks may be handled by an HTTP library, language runtime, operating system, or custom configuration
  • Do not disable certificate verification to clear errors after patching; that removes the protection the fix restores
  • Check dependency trees, including indirect dependencies
  • Rebuild and redeploy affected images, and confirm whether each application needs a reload, restart, or redeployment
  • Test the real TLS path; browser and curl tests don't prove that a background service using a different verifier is protected

Timeline:

  • Oct 19, about 17:00 UTC: Cloudflare becomes aware of the compromise and begins assessment
  • Oct 20, 02:00 UTC: WARP and 1.1.1.1 security updates published (the iOS Cloudflare One Agent update is awaiting app review)
  • Oct 20, 09:15 UTC: cloudflared security update published
  • Oct 20, 19:20 UTC: CDN and server-side Zero Trust mitigations fully deployed

Cloudflare also says the remediation is not finished.

Wrap-up

  • The private keys of eight eMudhra intermediate certificates were compromised, so certificates for any domain could be forged
  • No exploitation was found on Cloudflare's services
  • WARP, the 1.1.1.1 app, and cloudflared need updates to the listed versions
  • Review trust stores for mutual TLS, origin certificates, and Containers too
  • Don't work around errors by disabling certificate verification

If you use WARP or Tunnel, or run apps with their own trust stores, please check right away!

Related posts