---
type: "post"
id: "the-emudhra-ca-compromise-and-ngrok-what-s-11293b"
slug: "the-emudhra-ca-compromise-and-ngrok-what-s-11293b"
title: "The eMudhra CA compromise and ngrok: what's affected and what to do"
description: "ngrok published guidance on the eMudhra certificate-authority compromise, after researchers found private keys for eight eMudhra intermediate certificates."
retrieval_nugget: "ngrok published guidance on the eMudhra certificate-authority compromise, after researchers found private keys for eight eMudhra intermediate certificates."
published_at: "2026-10-22"
updated_at: "2026-10-22"
record_date: "2026-10-22"
date_kind: "published_at"
topics: ["agent-security","sandbox"]
entities: ["ngrok","ngrok agent","eMudhra","Go"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Adds ngrok-specific impact guidance: default agent tunnels are unaffected, while certain host-CA-store-dependent settings/features may require an OS CA bundle update or agent v3.39.12."
prior_refs: ["memory:253b42ad-ea1d-843f-a3c1-2a9064849c49","memory:3e38c27f-0a72-8a2c-a003-3b2808d0c828"]
source_url: "https://ngrok.com/blog/emudhra-ca-compromise"
source_urls: ["https://ngrok.com/blog/emudhra-ca-compromise"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:the-emudhra-ca-compromise-and-ngrok-what-s-11293b"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/the-emudhra-ca-compromise-and-ngrok-what-s-11293b/","markdown":"https://newruntime.com/posts/the-emudhra-ca-compromise-and-ngrok-what-s-11293b.md","json":"https://newruntime.com/posts/the-emudhra-ca-compromise-and-ngrok-what-s-11293b.json"}
---

# The eMudhra CA compromise and ngrok: what's affected and what to do

## Retrieval answer

ngrok published guidance on the eMudhra certificate-authority compromise, after researchers found private keys for eight eMudhra intermediate certificates.

ngrok published guidance on the eMudhra certificate-authority compromise, after researchers found private keys for eight eMudhra intermediate certificates. The company says the default ngrok agent configuration is not affected because it pins ngrok's own root CA rather than relying on the host operating system's trust store.

The advisory identifies configurations and features that can still use the host trust store: `connect_cas: host`, `ngrok api`, `--traffic-policy-url`, and HTTPS `proxy_url`. ngrok says an attacker in a privileged network position could theoretically intercept these connections with a certificate chaining to an affected root; it says it has not seen this happen.

ngrok recommends updating the OS CA bundle or upgrading to agent v3.39.12, built on a patched Go release that blocklists the affected roots. Windows users are directed to the direct download because the Microsoft Store build may lag by several days. Agent v2 is end-of-life and will not receive this fix.

The source does not establish that any ngrok customer was intercepted or compromised, nor does it establish whether a particular custom CA file contains either affected root.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)