Organisations urged to update Cloudflare clients to block weak eMudhra certs
Cloudflare is updating clients and servers to block eight compromised eMudhra intermediate certificates that allow attackers to forge secure connections.
Key points
- Cloudflare confirmed eight eMudhra intermediate certificates have weak private keys.
- Updates for Cloudflare One, WARP, and Tunnel clients are now available.
- Users must not disable certificate verification to fix dashboard errors.
Cloudflare is actively blocking eight compromised eMudhra intermediate certificates to prevent attackers from forging secure internet connections. The company discovered that the private keys for these certificates were weak, allowing malicious actors to create fake certificates for any domain. This vulnerability enables attackers to impersonate legitimate servers and intercept or modify user traffic without detection.
According to Cloudflare’s first-hand research, the issue was identified on 19 October 2026. The company immediately prioritised patching critical services to protect customers before public disclosure. While no active exploitation on Cloudflare services was found, the risk remains significant for any system trusting these specific certificates. Cloudflare has since released updates for its WARP, 1.1.1.1, and Tunnel applications.
View the original post on X
What we know
Cloudflare deployed mitigations across its CDN, Developer, and Zero Trust products shortly after the discovery. The company updated shared trust stores and base images to provide a common mitigation path for services inheriting certificate trust. Applications with bundled or custom trust stores received separate assessments and updates. This work addresses certificate-based authentication rather than weaknesses in TLS encryption algorithms.
Some customers must take action on software or trust configurations they operate, particularly on origin servers. Cloudflare advises reviewing mutual TLS trust stores and custom origin certificates. Users of Cloudflare Containers should review image dependencies for affected trust stores. Those using HTTPS egress interception are already protected by Cloudflare’s managed infrastructure mitigations.
Defender's checklist
- Upgrade Cloudflare One Client to version 2.5.6 for Android or 1.12.16 for iOS.
- Update Windows, macOS, and Linux desktop clients to version 2026.8.2115.0.
- Upgrade 1.1.1.1 app to v6.38.10 on Android or v6.31.7 on iOS.
- Update cloudflared (Cloudflare Tunnel) to version 2026.10.2 for container deployments.
The background in plain language
Certificate authorities issue digital IDs that prove a website is who it claims to be. Browsers trust these IDs to encrypt your data securely. If an attacker steals or recreates the secret key used to sign these IDs, they can forge fake certificates for any site. This allows them to sit between you and the website, reading or changing your data. Teams usually monitor trust stores to ensure only valid certificates are accepted, preventing these impersonation attacks.
Background: HTTPS
You should force HTTPS redirect on any public web server to prevent eavesdropping and data tampering. This configuration automatically sends visitors from the insecure port to the secure port using HTTP response codes. Public key infrastructure certificates validate your server identity during this handshake process.
Read the full guide: Should I force HTTPS redirect to secure your web traffic
What to do and how to stay safe: Cloudflare
- Check whether your organisation uses Cloudflare One, WARP, or Tunnel and apply the latest client updates immediately.
- Review any custom certificate trust stores or origin server configurations to ensure they do not rely on the compromised eMudhra certificates.
- Monitor dashboards for certificate errors after updating, but do not disable verification to suppress these alerts.
- Verify that API clients and application dependencies are updated, as SDK updates alone may not change underlying trust policies.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these certificates being actively exploited?
Cloudflare’s security review has not identified active exploitation of this issue on its services.
What should I do if I see certificate errors after updating?
Do not resolve these errors by disabling verification, as this removes the authentication protection.
Does this affect TLS encryption algorithms?
No, this incident addresses certificate-based authentication, not a weakness in TLS’s encryption algorithms.
