Sonatype is responding to the industry-wide eMudhra certificate authority incident, which affects certificate trust stores used by certain Sonatype products and distributions. We are updating affected components. Customers should follow our eMudhra security event page for product-specific remediation guidance and updates as they become available.
In the meantime, apply certificate trust-store updates provided by your operating-system, runtime, and application vendors.
What Happened
On October 17, 2026, a researcher reported that the private keys for eight eMudhra intermediate certificate authorities (CAs) could be recovered because they were generated with insufficient randomness. Six affected intermediates were for TLS certificates and two were for code signing. Someone with an affected TLS key could create a certificate for a website or service, which could be accepted by clients that still trust the affected chain.
Browser and operating system vendors have taken steps to block the affected certificates. Other software may rely on separate or bundled certificate trust stores that need updates, so organizations should also check systems beyond browsers and operating systems.
Sonatype Impact
We are preparing updated Docker images and patch releases with current certificate trust data. The tables below list the impacted Sonatype products and their remediation status. Existing Docker images and bundled JVMs do not update automatically.
For self-managed deployments, install the applicable updated Docker image or patch release when available.
For self-hosted solutions:
| Product | Impacted Versions | Remediation |
| Sonatype Nexus Repository | All versions released prior to October 21, 2026 | In progress |
| Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | 208 and earlier | In progress |
For cloud solutions:
| Product | Impacted? | Remediation |
| Sonatype Nexus Repository | Yes | In progress |
| Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | Yes | In progress |
| Sonatype Guide | Yes | In progress |
Continue to check the Sonatype Help documentation for updates. Do not manually change a product’s bundled JVM trust store unless Sonatype provides instructions for that product.
What Customers Must Do
Customers should take the following steps as soon as possible:
-
Update browsers and operating systems promptly.
-
Update certificate trust stores and any software that bundles a trust store, including containers and applications.
-
Follow Sonatype's security event and direct customer communications for safe product versions and any actions required for your deployment.
-
If you manage systems that use eMudhra-issued certificates, contact your certificate provider to confirm whether your certificate chain is affected and whether replacement or another action is needed.
-
Do not bypass certificate validation warnings.
What's Next
We are reviewing certificate trust in Sonatype products and distributions and preparing updates where needed. As revised versions become available, we will post product-specific guidance in our security event and relevant product update channels.
Tags
