The company says the default ngrok agent configuration is not affected because it pins ngrok's own root CA rather than relying on the host operating system's trust store.
The advisory identifies configurations and features that can still use the host trust store: connect_cas: host, ngrok api, --traffic-policy-url, and HTTPS proxy_url. ngrok says an attacker in a privileged network position could theoretically intercept these connections with a certificate chaining to an affected root; it says it has not seen this happen.
ngrok recommends updating the OS CA bundle or upgrading to agent v3.39.12, built on a patched Go release that blocklists the affected roots. Windows users are directed to the direct download because the Microsoft Store build may lag by several days. Agent v2 is end-of-life and will not receive this fix.
The source does not establish that any ngrok customer was intercepted or compromised, nor does it establish whether a particular custom CA file contains either affected root.