The private keys of eight eMudhra intermediate CA certificates were compromised, affecting TLS clients across languages and platforms. Atlas v1.3.5 is built with Go 1.26.10, which protects Atlas against certificates issued under them.
On October 17, 2026, a researcher reported that the private keys of eight eMudhra intermediate CA certificates could be recovered from the certificates themselves. Mozilla's incident report is Bug 2083449. With those keys, anyone could issue certificates that chain to widely trusted roots and use them to impersonate a server over TLS. eMudhra revoked the certificates on October 18.
What the Industry Is Doing
Browsers and operating systems blocked the intermediates: Firefox and Chrome on October 17, Apple on October 19, and Microsoft on October 20.
Software that checks certificates against its own trust store needs an update to stop trusting them. Fixes have shipped for:
- Go (CVE-2026-111943, in 1.27.3 and 1.26.10)
- Python (certifi)
- Rust (rustls-webpki and webpki-roots)
- PHP (Composer ca-bundle)
- The ca-certificates packages of major Linux distributions
Atlas v1.3.5
Atlas v1.3.5 and its Docker images, including arigaio/atlas and arigaio/atlas-operator, are built with Go 1.26.10. After upgrading, Atlas rejects TLS connections to servers whose certificates were issued under one of these intermediates. No configuration changes are needed.
Upgrade
curl -sSf https://atlasgo.sh | sh
brew upgrade ariga/tap/atlas
docker pull arigaio/atlas
Who Is Affected
- Any TLS client that relies on its own trust store and hasn't picked up a fix, in any language.
- For Go, that means software built with Go versions earlier than 1.26.10 and 1.27.3.
- Exploiting it requires a position on the network to intercept traffic.
To check which Go version a binary was built with, run:
go version $(which atlas)