Skip to main content
Publication date: October 26, 2026

​
Overview

A critical, industry-wide eMudhra Certificate Authority compromise affects some CockroachDB deployments via Go’s TLS trust store; not a CockroachDB code vulnerability. Cockroach Labs has updated its Go toolchain and recommends upgrading to patched versions. We have found no evidence of misuse against CockroachDB or any customer.

​
Vulnerability

​
Certificate Authority Compromise

On October 20, 2026, eight eMudhra intermediate Certificate Authority private keys were compromised, enabling anyone to issue a trusted certificate for any hostname. Unpatched CockroachDB builds would accept such a certificate on outbound connections that validate against the operating system trust store. CockroachDB is affected because its Go runtime trusts these compromised intermediates when validating TLS connections. The Go project shipped a fix in Go 1.27.3 and 1.26.10, and CockroachDB has updated its Go toolchain across all supported (and some legacy) release branches. To exploit this, an attacker would need to be positioned on the network between your cluster and a specific endpoint (backup bucket, changefeed sink, identity provider, LDAP server) and present the forged certificate in its place. Traffic inside a cloud provider’s network or over private endpoints is far harder to intercept than traffic crossing the public internet, and encrypted backups limit the impact of interception.

​
Fixed Versions

It is recommended to upgrade to v24.1.34, v24.3.37, v25.2.25, v25.4.18, v26.2.9, v26.3.3, or v26.4.0 as any versions prior to these are considered impacted.

​
Mitigation

Self-Hosted: For self-hosted deployments you will be able to upgrade to patched versions on your own timeline starting October 21, 2026, however quick adoption is recommended. Cloud: For CockroachDB Cloud and Continuum deployments, we started rolling out patched versions across all infrastructure October 21, 2026 which will be applied during normal maintenance windows.
  • Update OS and runtime trust stores on client machines
  • Update ccloud (Oct 20 build) and the Terraform provider (1.24.1)
  • Rotate Cloud API keys or SQL passwords used from untrusted networks since October 17.
Advanced clusters can route changefeeds and log exports over egress private endpoints to keep traffic off the public internet.

​
Additional Assistance

If more information or assistance is needed, contact the Cockroach Labs support team.

​
Where to Download Patch Versions:

v24.1.34 v24.3.37 v25.2.25 v25.4.18 v26.2.9 v26.3.3