---
type: "post"
id: "emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034"
slug: "emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034"
title: "eMudhra Security Advisory: eight intermediate CA keys were recoverable, so anyone could mint a trusted cert for any site."
description: "Vercel has published remediation guidance after private keys for eight eMudhra intermediate certificate authorities were found recoverable."
retrieval_nugget: "Vercel has published remediation guidance after private keys for eight eMudhra intermediate certificate authorities were found recoverable. Its managed platform has been updated or is rolling updates, but teams still own trust stores embedded in custom images, pinned packages, external runners, and end-of-life Node.js 20 deployments."
published_at: "2026-10-27"
updated_at: "2026-10-27"
record_date: "2026-10-27"
date_kind: "published_at"
topics: ["agent-security","sandbox"]
entities: ["Vercel","eMudhra","emSign","Node.js","Python certifi","Vercel Sandbox"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Vercel says it updated its managed infrastructure and runtimes, while identifying self-managed runtimes and Node.js 20.x as remaining exposure requiring action."
prior_refs: ["memory:711a223a-da53-8984-a5b8-c4371710e831","memory:253b42ad-ea1d-843f-a3c1-2a9064849c49"]
source_url: "https://vercel.com/kb/bulletin/emudhra-security-advisory-compromised-intermediate-ca-keys"
source_urls: ["https://vercel.com/kb/bulletin/emudhra-security-advisory-compromised-intermediate-ca-keys"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034/","markdown":"https://newruntime.com/posts/emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034.md","json":"https://newruntime.com/posts/emudhra-security-advisory-eight-intermediate-ca-keys-were-bb9034.json"}
---

# eMudhra Security Advisory: eight intermediate CA keys were recoverable, so anyone could mint a trusted cert for any site.

## Retrieval answer

Vercel has published remediation guidance after private keys for eight eMudhra intermediate certificate authorities were found recoverable. Its managed platform has been updated or is rolling updates, but teams still own trust stores embedded in custom images, pinned packages, external runners, and end-of-life Node.js 20 deployments.

## Summary

Vercel has published remediation guidance after private keys for eight eMudhra intermediate certificate authorities were found recoverable. Its managed platform has been updated or is rolling updates, but teams still own trust stores embedded in custom images, pinned packages, external runners, and end-of-life Node.js 20 deployments.

## What happened

On October 17, 2026, researchers found that private keys for eight intermediate certificate authorities operated by eMudhra, also called emSign, could be recovered. According to Vercel, possession of one of those keys would allow an attacker to issue a trusted certificate for any website. eMudhra revoked the affected intermediates on October 18, and major browsers and operating systems blocked them in the following days.

The operational issue is wider than browser revocation. Vercel says many non-browser clients do not check certificate revocation status. A client can therefore remain exposed if it still trusts the roots above the compromised intermediates and an attacker can intercept its connection, for example on public Wi-Fi, a hostile hotspot, or through hijacked DNS. Node.js, Python's certifi package, Go, and many container images can each ship their own root certificate list. Each copy needs an update before it stops trusting the affected roots.

Vercel says it has updated its infrastructure and the managed runtimes it operates. Its edge network, control plane, and internal services no longer trust the affected roots. The build environment and managed Node.js 22, 24, and 26 versions used in builds have also been updated. Existing deployments receive managed Vercel Functions runtime updates without a redeploy, although Vercel says the Functions rollout is still in progress and it will update the advisory when complete. Image Optimization no longer trusts the roots.

Sandbox has a more specific mitigation. Vercel republished managed Node.js and Python images with updated certificate lists. When a Sandbox starts, it also removes the affected roots from the system certificate store, which Vercel says protects Sandboxes restored from older snapshots without modifying the saved snapshot. This does not cover software added by a customer that maintains its own certificate store.

The remaining work sits with operators of unmanaged software. Vercel calls out a Node.js or Python runtime installed inside a Sandbox or custom base image, customer-built container images, and pinned certifi dependencies. It identifies AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3 as the roots to check. For external backends, CI runners, and developer machines, it points to Node.js 22.23.4, 24.22.1, and 26.12.1, certifi 2026.10.19, and the current Homebrew ca-certificates package as releases that remove the affected roots. Node.js 20 is end of life and will not receive an updated certificate list; Vercel advises moving projects to Node.js 22 or newer and redeploying.

## What the archive adds

This is a new operational update on a known incident, not a restatement. [eMudhra Intermediate CA Compromise](https://newruntime.com/posts/emudhra-intermediate-ca-compromise-analysis-a954d2/) established that removal from trust stores, not browser blocking alone, determines the operational impact. [How Weaviate responded to the eMudhra certificate compromise](https://newruntime.com/posts/how-weaviate-responded-to-the-emudhra-certificate-compromise-87b538/) documented a separate response focused on patching customer infrastructure. Vercel now specifies which parts of its hosted platform are covered and which copies of trust must still be owned by customers.

## Trend signal

This supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The relevant security boundary here is not an application-level promise or a browser warning; it is the certificate store actually used by the runtime making an outbound connection. Managed runtimes can be remediated centrally, while vendored packages and custom images preserve separate exposure.

## Why now

The timing follows the October 17 discovery and October 18 revocation. Browser and operating-system blocks arrived within days, but Vercel's advisory makes clear that independently packaged trust stores do not automatically inherit that protection. The immediate task is to find those separately maintained clients before relying on the broader platform rollout.

## Connections to other events

The earlier Weaviate response documented patching an estate after the same eMudhra compromise, including customer systems and infrastructure. Vercel's advisory describes the complementary platform-side problem: managed services can change centrally, but external backends, CI runners, developer machines, custom base images, and pinned dependencies remain outside that boundary.

## Why it matters

AI teams increasingly run code across hosted functions, build systems, agent sandboxes, local developer machines, and self-managed services. All of those systems make outbound TLS connections for package installation, model calls, retrieval, data access, and deployment. A centrally managed platform update reduces one class of risk, but it is not an inventory of every TLS client a team operates.

The actionable distinction is between a runtime Vercel manages and a trust store the team has embedded or pinned. Treat certificate roots as a deployable dependency, not as invisible operating-system background. In particular, a project can look current at the application layer while its CI image, development laptop, or custom Sandbox installation continues to accept a compromised chain. Node.js 20 makes that gap explicit because it will not receive the root-store correction.

## What happens next

- **Teams will uncover unmanaged trust stores in CI, custom images, and pinned dependencies.** (3 months, 75%). Watch for: package and image updates that explicitly remove the eMudhra roots.
- **Node.js 20 projects on Vercel will migrate or retain a known trust-store exception.** (6 months, 70%). Watch for: version-setting changes to Node.js 22 or newer and related redeploys.

## Limits and uncertainty

The advisory describes Vercel's own mitigations and the versions it identifies as updated; it does not establish that every Vercel Functions runtime rollout has completed, only that the rollout is in progress. It also does not provide a universal inventory of applications that bundle the affected roots, nor evidence that any particular customer was intercepted. The source describes exposure conditions rather than observed exploitation. Teams must determine which TLS library and certificate bundle each of their own processes actually uses, especially where a dependency vendors certificates or an image was built long ago.

## Skill to build now

Create a small trust-store inventory for production and development execution paths this week. List each build image, container base image, CI runner, function runtime, Sandbox customization, external backend, and developer environment; record whether its certificate bundle is platform-managed, OS-managed, or bundled by a language package. Upgrade or rebuild any customer-owned path that still trusts AAA Certificate Services, emSign Root TLS CA - G3, or emSign ECC Root CA - G3. Use the test endpoints referenced by Vercel to confirm that the client rejects the affected roots.

## Reader takeaway

Vercel's managed services reduce the immediate exposure, but the incident is fundamentally about every independent copy of a trust store. If a team owns the runtime, image, package pin, runner, or workstation, it must verify that client separately. Moving off Node.js 20 is part of the remediation, not merely routine maintenance.

## Open question

How quickly will teams identify certificate bundles hidden inside customer-built images and language dependencies, rather than only updating the runtimes their cloud platform manages?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)