Key points
- Eight eMudhra intermediate certificates with weak private keys are compromised, allowing forged SSL certificates.
- Cloudflare has deployed mitigations across its CDN, Zero Trust, and Tunnel products to block these certificates.
- Customers must update Cloudflare One clients and review origin server trust stores to prevent service interruptions.
The short version
- Cloudflare detected that eight intermediate certificates issued by eMudhra have private keys that are cryptographically weak.
- The company has pushed updates to Cloudflare One, 1.1.1.1, and Tunnel clients to stop trusting these compromised certificates.
- Organizations using Cloudflare services must verify their configurations and update software to avoid certificate validation errors.
The details
Cloudflare announced on October 19, 2026, that it identified compromised private keys associated with eight intermediate certificates from eMudhra. According to the company’s security blog, these keys are weak enough that an attacker can generate forged certificates for any domain. This capability allows threat actors to impersonate servers and intercept or modify network traffic.
Cloudflare stated that the certificates were widely trusted by browsers, operating systems, and its own infrastructure. The company prioritized patching its critical services before making the vulnerability public. Its internal security review did not find any evidence of active exploitation on Cloudflare’s network at the time of the announcement.
View the original post on X
The context
Cloudflare released updates for its client software, including Cloudflare One, the 1.1.1.1 app, and Cloudflare Tunnel. Specific version numbers were provided for Android, iOS, Windows, macOS, and Linux platforms. The company also deployed mitigations across its CDN, Developer, and Zero Trust products.
According to Cloudflare, customers using Zero Trust with Gateway and an up-to-date client are automatically protected by these changes. The firm updated shared trust stores and base images to provide a common mitigation path for services that inherit certificate trust from those sources. Cloudflare noted that this work addresses certificate-based authentication rather than a weakness in TLS encryption algorithms.
What to watch
Organizations need to review their custom origin certificates and server configurations, particularly if they use Full (strict) encryption mode or Strict mode. Cloudflare is updating Automatic SSL/TLS to notify users if they still rely on the distrusted certificates, which would cause service breakages. Customers using Cloudflare Containers or Sandboxes should review their container images and application dependencies for affected certificate trust stores. The company advised that updating an SDK alone may not change the underlying policy if an API client delegates verification to an OS or custom configuration.
What it means for organisations
Security teams must immediately inventory all systems relying on public certificate trust stores. Operations leaders should prepare for potential service interruptions if origin servers or internal applications still trust the compromised eMudhra certificates. Communication plans should alert developers and infrastructure managers to check container images and custom trust configurations.
This incident highlights the risk of centralized trust failures; organizations should consider diversifying certificate authorities and implementing strict certificate pinning where feasible. Regular audits of trust stores are essential to detect and mitigate similar cryptographic weaknesses before they impact production environments.
Background: Encryption
Encryption is the process of converting plain text into ciphertext using an algorithm and a key. It prevents unauthorized access to data at rest and in transit. Without the correct decryption key, the information remains unintelligible, protecting privacy and integrity against interception or theft.
Read the full guide: What Is Encryption: Meaning, Definition, and How It Works
What to do and how to stay safe: Cloudflare
- Update Cloudflare One, 1.1.1.1, and Cloudflare Tunnel clients to the latest recommended versions provided by the vendor.
- Review and update mutual TLS trust stores and uploaded CAs used to verify client certificates in your infrastructure.
- Check origin server configurations, especially those using Full (strict) or Strict encryption modes, to ensure they do not rely on compromised certificates.
- Monitor dashboards for certificate errors after patching and resolve them by updating trust stores, not by disabling verification.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are the eMudhra certificates being actively exploited?
Cloudflare’s security review has not identified active exploitation of this issue on Cloudflare services as of the announcement.
What versions of Cloudflare One should I update to?
Users should upgrade to v2.5.6 for Android, v1.12.16 for iOS, and 2026.8.2115.0 for Windows, macOS, and Linux.
Will this fix affect my encrypted data?
No, this work addresses certificate-based authentication and trust stores, not a weakness in TLS’s encryption algorithms.
