Cloudflare patches clients to block forged eMudhra certificates
Cloudflare deployed updates for WARP and Tunnel after finding eight compromised intermediate certificates that allow traffic interception.
Key points
- Eight eMudhra intermediate certificates with weak keys were compromised on October 19, 2026.
- Cloudflare released client updates for WARP, 1.1.1.1, and Tunnel to mitigate the risk.
- Users must not disable certificate verification to resolve errors caused by these updates.
Cloudflare has released updates for its One Clients and Tunnel software to address a compromise involving eight eMudhra intermediate certificates. The company detected that the private keys for these certificates were weak on October 19, 2026. This weakness allows attackers to create forged certificates for any domain, enabling them to impersonate servers and intercept or modify network traffic.
What is the scope of the compromise?
The compromised certificates were widely trusted by browsers, operating systems, and Cloudflare’s own infrastructure. Because the keys themselves were weak, an attacker could generate a valid-looking certificate for any website. This does not represent a flaw in TLS encryption algorithms, but rather a failure in certificate-based authentication. Cloudflare stated that its security review found no evidence of active exploitation of this issue on its services at the time of disclosure.
View the original post on X
Which Cloudflare products are affected?
Cloudflare prioritized patching critical services that use public certificates to authenticate remote endpoints. This includes proxies connecting to origins and applications calling external APIs. The company updated shared trust stores and base images to provide a common mitigation path. Customers using Cloudflare Zero Trust with Gateway and an up-to-date client are automatically protected. Cloudflare Containers and Sandboxes also require review of their images and dependencies.
What versions should teams install?
Teams should upgrade Cloudflare One Clients to version 2.5.6 for Android, 1.12.16 for iOS, and 2026.8.2115.0 for Windows, macOS, and Linux. The 1.1.1.1 app requires version 6.38.10 for Android, 6.31.7 for iOS, and 2026.8.2115.0 for desktop operating systems. Cloudflare Tunnel users must upgrade to version 2026.10.2. For container deployments, teams need to update and redeploy the fixed image.
What operational steps are required next?
Organizations using customer-configured TLS client authentication must review and update their mutual TLS trust stores. Those using Full (strict) encryption mode or Strict mode should review custom origin certificates. Cloudflare is updating Automatic SSL/TLS to notify users if they still use distrusted certificates, which would cause service breakages. Enabling HTTPS egress interception can route outbound requests through Cloudflare, allowing its trust-store mitigations to protect connections.
Questions to ask your suppliers
Ask vendors whether their software bundles its own certificate trust store or relies on the operating system. Determine if their APIs delegate certificate verification to external libraries that might bypass your internal security policies. Request a timeline for patches if their products depend on the compromised eMudhra certificates. Ensure your procurement team understands that updating SDKs alone may not fix underlying trust configurations. Inform your legal and risk teams about potential service disruptions during the patching process.
What to do and how to stay safe: Cloudflare
- Update all Cloudflare One, 1.1.1.1, and Tunnel clients to the specified versions immediately.
- Review custom origin certificates and mutual TLS trust stores for affected eMudhra certificates.
- Monitor dashboards for certificate errors and do not disable verification to resolve them.
- Enable HTTPS egress interception to leverage Cloudflare’s managed trust-store mitigations.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are the compromised certificates being actively exploited?
Cloudflare’s security review has not identified active exploitation of this issue on its services.
Does this affect TLS encryption algorithms?
No, this incident addresses certificate-based authentication, not a weakness in TLS’s encryption algorithms.
What should I do if I see certificate errors after patching?
Do not disable verification, as this removes the authentication protection the updates are intended to restore.
