Skip to content

Tenzir Platform v1.37.4: Removal of the compromised eMudhra root certificate

Choose a tag to compare

View all tags
@tenzir-github-app tenzir-github-app released this 29 Oct 14:57
· 25 commits to main since this release
v1.37.4
This tag was signed with the committer’s verified signature.
tenzir-bot
GPG key ID: 4C1D5E45F17CF93C
Verified
Learn about vigilant mode.
d2bc9d5
This commit was signed with the committer’s verified signature.
tenzir-bot
GPG key ID: 4C1D5E45F17CF93C
Verified
Learn about vigilant mode.

This release removes the compromised eMudhra emSign ECC Root CA - G3 from all Tenzir Platform container images and includes the latest container scan dependency upgrades.

🐞 Bug fixes

Removal of the compromised eMudhra root certificate from container images

The Tenzir Platform services no longer trust certificates issued under the emSign ECC Root CA - G3 root. In October 2026, the private keys of eight eMudhra intermediate CAs under this root were found to be compromised, which would allow forging trusted TLS certificates for any domain. Mozilla and Google have removed the root from their trust stores in response.

The platform API, gateway, UI, CLI, and SeaweedFS images now ship trust stores without this root. Connections to services that use certificates from other eMudhra roots are unaffected.

The images also include the dependency upgrades from the weekly container scans:

  • pyjwt to 2.15.1 and urllib3 to 2.8.0 in the platform API, gateway, and CLI images
  • brace-expansion, devalue, shell-quote, and source-map-js in the UI images

By @lava.

Contributors

lava
Assets 2
Loading