Go Ecosystem Acts After eMudhra Certificate Authority Key Compromise
The report covers a public key infrastructure incident in which private keys for eight eMudhra intermediate CA certificates were exposed. It says the compromise could let attackers issue certificates that appear valid to affected clients, prompting responses from browser, language, certificate-store, and software maintainers.
The incident centers on eight eMudhra intermediate CA certificates whose private keys were exposed. Six were TLS intermediates covering domain-, organization-, and extended-validation certificates; the other two were code-signing intermediates. Because intermediates sit beneath trusted roots, their key loss carries greater risk than an ordinary site certificate compromise.
Go addressed the issue through CVE-2026-111943. Versions 1.26.10 and 1.27.3 add a crypto/x509 denylist so verification fails when a chain includes a known compromised intermediate. Browsers, certificate stores, language ecosystems, and software maintainers also took emergency steps.
The exposure could affect organizations and individuals relying on TLS and code-signing trust, including website operators, software publishers, and end users. If fraudulent certificates were accepted, encrypted traffic or signed software might appear legitimate, potentially enabling interception or malware distribution. The Go denylist and broader ecosystem responses may reduce exposure for updated systems, but unpatched clients and dependent applications could remain at risk.