JA EN
shiichan

Update Sandbox SDK to 0.12.14 Now: Fixing Trust After the eMudhra Compromise

Cloudflare Changelog ★★★★★ View Markdown
#cloudflare#security#serverless

Hi everyone, it's Shii-chan! Today's news is a serious security notice. If you use Sandbox SDK, please check this one!

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog says Sandbox SDK 0.12.14 updates its trusted certificates after the eMudhra compromise.

The private keys of eight eMudhra intermediate certificate authorities can be recovered, so anyone can forge a certificate for any hostname that chains to them.

Why it matters

Sandbox SDK images before 0.12.14 trust these certificates. That means an HTTPS connection that leaves the container directly could be intercepted with a forged certificate.

Examples of affected connections:

  • mountBucket()
  • Backups
  • gitCheckout()
  • Tunnels
  • Code that runs in the sandbox

What changes

After updating, the images reject the compromised certificates. The steps differ by version: on 0.x, update immediately. On 1.x, the SDK itself doesn't need an update, but you need to rebuild your image.

Dive Deep

Sandbox SDK 0.x

  • Install @cloudflare/sandbox@0.12.14
  • Change the FROM line in your Dockerfile to the matching image, keeping any -python, -opencode, or -musl suffix
  • Redeploy. The rollout replaces running sandboxes with ones that use the new image
  • If you use the next prerelease, update to 0.13.0-next.825.1 or later
FROM docker.io/cloudflare/sandbox:0.12.14

If you can't update yet (0.8.7 or later)

Send all HTTPS through your Worker, so Cloudflare checks every certificate on port 443 whatever your image trusts.

import { Sandbox, ContainerProxy } from "@cloudflare/sandbox";

export { ContainerProxy };

export class MySandbox extends Sandbox {
  interceptHttps = true;
}

MySandbox.outbound = (request) => fetch(request);

Deploy, then stop running sandboxes so they restart with the interception certificate. This doesn't cover TLS on other ports, such as cloudflared tunnels, and clients that ignore the injected certificate will fail to connect.

Sandbox SDK 1.x

The SDK makes no TLS connections itself, so no update is needed. Rebuild your image instead:

  • Pull each base image in your Dockerfile and run docker builder prune --all. Without this, wrangler deploy may ship old CA certificates and runtimes. If you reference an image by digest, build and push a new image and update the digest
  • Deploy your Worker
  • Stop running sandboxes, for example with this.ctx.container.destroy(), because a running sandbox keeps its original image
  • If you use snapshots, create new ones from sandboxes running the updated image, because a snapshot restores its original image and certificates

Verifying

From inside a sandbox, connect to the test hosts listed at emudhra.we-have-a-problem.com with each TLS client you use, such as curl, node, or bun. Every request should fail.

What changed in 0.12.13 and 0.12.14

  • 0.12.13: The system CA bundle, Node.js, cloudflared, and pip reject the compromised certificates. Images include updated Ubuntu and Alpine CA certificates, Node.js 22.23.4, cloudflared 2026.10.2, and pip 26.2.2 (in the -python image)
  • 0.12.14: Updates Bun to 1.4.4, so the bun command and createBackup() uploads of archives 10 MiB or larger also reject these certificates. The -opencode image ships OpenCode 1.19.4 or later, which runs on Bun 1.4.4

Wrap-up

  • The private keys of eight eMudhra intermediate CAs can be recovered, so forged certificates are possible
  • Images before 0.12.14 are affected
  • On 0.x, update to @cloudflare/sandbox@0.12.14 now and redeploy
  • On 1.x, rebuild your image and recreate sandboxes and snapshots
  • If you can't update, interceptHttps offers a stopgap through your Worker

This is for anyone running agents or code execution on Sandbox SDK. Please check it today!

Related posts