Skip to main content
Last updated: 2026-10-23 On October 19, private keys for several eMudhra intermediate certificate authorities were reported compromised. No exploitation has been reported. Exposure for Aspect Workflows is low. Aspect’s own endpoints are not affected. Workflows services only make outbound connections to a small set of known hosts, and none of them use eMudhra-issued certificates. Out of an abundance of caution, we have rebuilt every image and updated the TLS libraries in all of our binaries so they no longer trust the affected certificate authorities.

​
What we changed

  • Aspect Workflows 6.0.44 removes the affected authorities from the remote cache, runners and Workflows services. See the .
  • Aspect CLI v2026.43.5 and later no longer trust the affected authorities.

​
What we recommend

  • Upgrade to Aspect Workflows 6.0.44. Apply outside peak CI hours. The release notes list the hosts that restart during the upgrade.
  • Update the Aspect CLI to v2026.43.5 or later.

​
CI runner images

  • We recommend you analyze your CI runner AMIs and GCP images for exposure and rebuild them per your company policies. Updating the ca-certificates package removes the affected authorities.
  • Aspect-provided starter images have been patched. Images dated 20261021-0 or later carry the fix. See workflows-images.

​
Bazel

  • Bazel 9.3.1 and 8.8.2 no longer trust the affected authorities. We recommend upgrading to one of these versions. Bazelisk 1.30.0 contains the same fix.
  • Bazel 9.3.1 removes some deprecated APIs, so older rulesets may fail at analysis time. For example, The CcInfo symbol has been removed indicates an outdated rules_go or gazelle. Upgrade to rules_go 0.65.0 and gazelle 0.54.0 or later, and check other rulesets for 9.x compatible releases.

​
References