Cve/emudhra

Finds and fixes Linux, macOS and Windows hosts and Linux containers that still trust the eight eMudhra intermediate CAs whose private keys were compromised (reported to the root programs 2026-10-17, public 2026-10-20). Anyone holding one of those keys can issue a certificate for any domain that an unpatched client accepts. No source reports misuse so far.

Methods

• scan — scan one host (local, SSH, or Docker container or image)
• scanFleet — scan many SSH hosts in parallel
• mitigate — scan, then fix the OS trust store and upgrade affected agents; dryRun defaults to true

What It Checks

• OS trust store: the verdict comes from each platform's own verifier, for every compromised intermediate: openssl verify against the host's bundle on Linux, security verify-cert on macOS, and CryptoAPI (including Microsoft's disallowed list) on Windows. Also reports the Linux ca-certificates version against the fixed version.
• Runtimes with bundled roots: node, deno (fixed in 2.9.8), swamp (fixed from 20261021.223953, built on Deno 2.9.8), bun (no release yet), go, and Electron apps.
• Language stores and bundles, matched by public key: Java trust stores (read without keytool, honouring blocked.certs), Python certifi and pip's copy, Homebrew and Git for Windows bundles, and, under searchPaths, Cargo.lock (webpki-roots, rustls-webpki), mix.lock and rebar.lock (hex certifi, castore, tls_certificate_check).
• Agents: cloudflared (fixed in 2026.10.2) and Cloudflare One/WARP (2026.8.2115.0).
• Live check (liveCheck=true): curl and openssl against the eMudhra test hosts. It only proves those two verifiers.

Verdicts

trusted (exposed), not-trusted (clean), or unknown. Components are fixed, exposed, no-fix-released, or unknown.

Privileges

scan needs no root and never uses sudo. It writes nothing to the target except temporary files it removes (macOS certificate files; the probe and its output when swamp runs on Windows and scans over SSH). On Linux, mitigate runs as root, or runs each command as sudo -n -- <binary> after checking with sudo -n -l that sudo allows the full command; otherwise the host is needs-privilege, nothing is changed, and a mitigationScript is saved to run yourself. On Windows it adds the intermediates to the Disallowed store in an elevated administrator session, or saves a .ps1. On macOS it saves a deny-trust script to run locally. Containers are never modified; mitigate reports rebuild-image with the Dockerfile change. It never disables certificate verification.