Sonatype is responding to the industry-wide eMudhra certificate authority incident, which affects certificate trust stores used by certain Sonatype products and distributions. We are updating affected components. In the meantime, apply certificate trust-store updates provided by your operating-system, runtime, and application vendors.
What Happened
On October 17, 2026, a researcher reported that the private keys for eight eMudhra intermediate certificate authorities (CAs) could be recovered because they were generated with insufficient randomness. Six affected intermediates were for TLS certificates and two were for code signing. Someone with an affected TLS key could create a certificate for a website or service, which could be accepted by clients that still trust the affected chain.
Browser and operating system vendors have taken steps to block the affected certificates. Other software may rely on separate or bundled certificate trust stores that need updates, so organizations should also check systems beyond browsers and operating systems.
Sonatype Impact
We are preparing updated Docker images and patch releases with current certificate trust data. The tables below list the impacted Sonatype products and their remediation status. Existing Docker images and bundled JVMs do not update automatically.
For self-managed deployments, install the applicable updated Docker image or patch release when available.
For self-hosted solutions:
| Product | Impacted Versions | Remediation |
| Sonatype Nexus Repository | All versions released prior to October 21, 2026 | In progress |
| Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | 208 and earlier | In progress |
For cloud solutions:
| Product | Impacted? | Remediation |
| Sonatype Nexus Repository | Yes | Complete |
| Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | Yes | Complete |
| Sonatype Guide | Yes | Complete |
Continue to check the Sonatype Help documentation for updates. Do not manually change a product’s bundled JVM trust store unless Sonatype provides instructions for that product.
What Customers Must Do
Customers should take the following steps as soon as possible:
-
Update browsers and operating systems promptly.
-
Update certificate trust stores and any software that bundles a trust store, including containers and applications.
-
If you manage systems that use eMudhra-issued certificates, contact your certificate provider to confirm whether your certificate chain is affected and whether replacement or another action is needed.
-
Do not bypass certificate validation warnings.
What's Next
We are reviewing certificate trust in Sonatype products and distributions and preparing updates where needed. As revised versions become available, we will post product-specific guidance in our security event and relevant product update channels.
The eMudhra certificate authority incident is tracked as CVE-2026-111943 in Go and related ecosystem projects. Organizations may also see related advisories, including CVE-2026-113470 for Amazon Linux packages and RHSB-2026-012 from Red Hat. These identifiers support tracking across affected software and trust stores; remediation may differ by product and environment.
For vulnerability details, visit Sonatype Guide's CVE-2026-111943 page. Sonatype Guide is free to subscribe to. For remediation, follow the applicable guidance from your operating system, runtime, and application vendors.
Tags
