Threat reportVulnerabilityTL-2026-4034
CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident
CVE-2026-111943 (TL-2026-4034), also tracked as eMudhra intermediate CA key compromise, is a high-severity software vulnerability, first published 2026-10-21. It has no confirmed attribution, affects Go Go standard library (crypto/x509), references 2 CVEs (CVE-2026-111943, CVE-2026-113470), maps to 5 MITRE ATT&CK techniques (T1553, T1553.002, T1557), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4034
- Threat ID
- TL-2026-4034
- Also known as
- eMudhra intermediate CA key compromise
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, finance, government administration, telecoms
- Target regions
- Global, india, united states of america, Europe
- Detection rules
- 9
- Indicators of compromise
- 15
How CVE-2026-111943 works
Private keys for eight eMudhra intermediate CA certificates (six TLS, two code-signing) were trivially recoverable because a flawed April 2025 key ceremony produced weak keys, some of them single-byte values. Chrome, Mozilla, Apple and Microsoft blocked the certificates, and Go 1.26.10 and 1.27.3 reject chains containing the eight keys (CVE-2026-111943). No TLS certificate chaining to the six website intermediates had been logged to Certificate Transparency before Chrome blocked them.
On 2026-10-17 a researcher known as Wayne reported to Chrome (18:05 UTC), Mozilla (20:06 UTC) and other root programs that the private keys for eight eMudhra intermediate CA certificates were compromised. The researcher demonstrated possession by signing a message ("We have a problem here - Wayne") with all eight keys. The affected intermediates are EM DV TLS CA - G3B/G3C, EM OV TLS CA - G3B/G3C, EM EV TLS CA - G3B/G3C and EM OV CS CA - G3B/G3C (code signing). The G3B certificates belong to eMudhra BV (Netherlands) and the G3C certificates to eMudhra Inc. (United States). They chain to emSign ECC Root CA - G3 and were also cross-signed by Sectigo's AAA Certificate Services root. Per Scott Helme's analysis, the P-384 private keys were single-byte integers, so recovery means computing 1xG, 2xG, 3xG and so on until the result matches the certificate's public key. That is at most 255 steps and finishes in milliseconds. Mozilla independently reproduced the recovery within about two hours of the report.
Root cause, per eMudhra's statement: a flaw in the key wrap/unwrap procedure of the Key Generation Ceremony held on 2025-04-30 produced a second, weak set of keys alongside the intended strong keys, and the weak set was what was published to browser root stores. Reporting on the Mozilla incident ticket attributes it to an HSM ceremony script bug combined with a human error in selecting the wrong key pair for signing. eMudhra says seven of the intermediates were never deployed in production, one was deployed but issued no end-entity certificates, no root CA keys were compromised, and customer impact was limited to one US customer ecosystem. All eight intermediates were revoked on 2026-10-19.
Impact: anyone able to compute these keys could mint certificates that chain to a trusted root. Against TLS clients that do not require Certificate Transparency or revocation checking, a network-positioned attacker could use such certificates to impersonate websites and read or modify traffic. The code-signing intermediates raise the risk of forged code-signing certificates. Browsers that require CT logging, such as Chrome, were largely protected, because no TLS certificate chaining to the six TLS intermediates appeared in CT logs before the block. Non-browser clients (curl, Python, Node.js, Go, Java, git, package managers) lack CT checking and default revocation validation and need explicit updates.
Response: Chrome deployed a CRLSet block at 19:45 UTC on 2026-10-17. Mozilla distributed a OneCRL block at 22:59 UTC the same day. Apple blocked the certificates on 2026-10-18/19, and Microsoft on 2026-10-19/20. Android received a block via Google Play Services. Fixed software releases: Go 1.26.10 and 1.27.3 (CVE-2026-111943, rejecting chains that contain the eight keys, rebuild required), Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1, NSS 3.131.1 (removes emSign ECC Root CA - G3), Python certifi 2026.10.19, Rust webpki-roots 1.0.10, Composer ca-bundle 1.6.0/1.4.16, and Cloudflare cloudflared 2026.10.2. A Node.js fix was pending at the time of the cited reporting. No in-the-wild abuse was demonstrated before the block. CVSS is not stated by any source, and severity HIGH is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-4034
defense-impairment
T1553 Subvert Trust Controls; T1553.002 Code Signing
Credential Access
T1557 Adversary-in-the-Middle; T1649 Steal or Forge Authentication Certificates
Collection
Resource Development
Affected products and versions in CVE-2026-111943
- Go — Go standard library (crypto/x509)
Vulnerable versions: < 1.26.10; 1.27.0 - 1.27.2
Fixed in: 1.26.10; 1.27.3 - Mozilla — Firefox / Firefox ESR / Thunderbird / NSS
Vulnerable versions: Firefox < 158.0.1; ESR < 115.43.1; ESR < 153.5.1; NSS < 3.131.1
Fixed in: Firefox 158.0.1; ESR 115.43.1; ESR 153.5.1; NSS 3.131.1 - Python Software Foundation — certifi
Vulnerable versions: < 2026.10.19
Fixed in: 2026.10.19 - Rust community — webpki-roots
Vulnerable versions: < 1.0.10
Fixed in: 1.0.10 - Composer — ca-bundle
Vulnerable versions: < 1.6.0; < 1.4.16
Fixed in: 1.6.0; 1.4.16 - OpenJS Foundation — Node.js
Vulnerable versions: all versions at time of reporting
Fixed in: pending
Remediation for CVE-2026-111943
Patches
- Go 1.26.10 and Go 1.27.3
- Firefox 158.0.1, Firefox ESR 115.43.1, Firefox ESR 153.5.1
- NSS 3.131.1
- cloudflared 2026.10.2
Immediate actions
- Rebuild Go binaries with Go 1.26.10 or 1.27.3 or later
- Update bundled root stores: NSS 3.131.1, Python certifi 2026.10.19, Rust webpki-roots 1.0.10, Composer ca-bundle 1.6.0/1.4.16
- Update Firefox to 158.0.1 (ESR 115.43.1 / 153.5.1) and apply OS trust store updates
- Check certificate chains in TLS logs and inspection tools against the published list of eight affected intermediates
Workarounds
- Remove or distrust emSign ECC Root CA - G3 and the eight eMudhra G3B/G3C intermediates in custom trust stores until patched
- Block the eight intermediates by public key (Chrome CRLSet and Mozilla OneCRL do this)
Longer-term hardening
- Enforce Certificate Transparency and revocation checking in non-browser clients where supported
- Inventory custom keystores, mTLS trust stores, proxies and appliances that bundle CA roots
- Track Node.js releases for the pending fix to block the eight keys
CVEs associated with CVE-2026-111943
Weaknesses (CWE) in CVE-2026-111943
Timeline of CVE-2026-111943
- eMudhra Key Generation Ceremony creates eight intermediate CAs; a flaw in the key wrap/unwrap step also produces a weak second key set, which is the set published to root stores
- Intermediates are cross-signed by Sectigo's AAA Certificate Services root (May 2025 per Helme analysis; day not stated, first of month used as placeholder)
- Mozilla independently reproduces the key recovery and distributes a OneCRL block at 22:59 UTC
- Chrome deploys a CRLSet block at 19:45 UTC for the six TLS intermediates
- Researcher Wayne reports the compromise to Chrome (18:05 UTC) and Mozilla (20:06 UTC), proving control by signing a message with all eight private keys
- eMudhra revokes all eight intermediates; Apple and Android block the certificates around this date
- Mozilla publishes its advisory; Firefox 158.0.1, NSS 3.131.1, Go 1.26.10 / 1.27.3 (CVE-2026-111943) and certifi 2026.10.19 are released
- Microsoft blocks the certificates
- eMudhra publishes its incident statement and press release attributing the cause to a ceremony key wrap/unwrap flaw; SOC Prime publishes its CVE-2026-111943 analysis
- Chrome root store removal expected to reach all devices (expected date per Hacker News reporting)
Sources cited for CVE-2026-111943
- CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident
- Protecting Firefox users following the compromise of eMudhra intermediate certificates
- Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
- Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
- eMudhra Statement on Recent Certificate Security Incident
- eMudhra Intermediate CA Compromise (proof and affected intermediates list)
- eMudhra intermediate CA compromise (LWN.net)
- eMudhra CA Key Compromise: Chrome and Firefox Have Blocked It, Non-Browser Clients Need Updates Now
- Indian certification authority eMudhra's private keys compromised
Detection coverage for TL-2026-4034
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4034 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.