> ## Documentation Index
> Fetch the complete documentation index at: https://aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# eMudhra certificate compromise

Last updated: 2026-10-23

On October 19, private keys for several eMudhra intermediate certificate authorities were reported compromised. No exploitation has been reported.

Exposure for Aspect Workflows is low. Aspect's own endpoints are not affected. Workflows services only make outbound connections to a small set of known hosts, and none of them use eMudhra-issued certificates. Out of an abundance of caution, we have rebuilt every image and updated the TLS libraries in all of our binaries so they no longer trust the affected certificate authorities.

## What we changed

* Aspect Workflows 6.0.44 removes the affected authorities from the remote cache, runners and Workflows services. See the [release notes](https://aspect.build/docs/aspect-workflows/enterprise/customers/release-notes/workflows_6_0.md#6-0-44-2026-10-23).
* Aspect CLI v2026.43.5 and later no longer trust the affected authorities.

## What we recommend

* Upgrade to Aspect Workflows 6.0.44. Apply outside peak CI hours. The release notes list the hosts that restart during the upgrade.
* Update the Aspect CLI to v2026.43.5 or later.

## CI runner images

* We recommend you analyze your CI runner AMIs and GCP images for exposure and rebuild them per your company policies. Updating the `ca-certificates` package removes the affected authorities.
* Aspect-provided starter images have been patched. Images dated `20261021-0` or later carry the fix. See [workflows-images](https://github.com/aspect-build/workflows-images).

## Bazel

* Bazel 9.3.1 and 8.8.2 no longer trust the affected authorities. We recommend upgrading to one of these versions. Bazelisk 1.30.0 contains the same fix.
* Bazel 9.3.1 removes some deprecated APIs, so older rulesets may fail at analysis time. For example, `The CcInfo symbol has been removed` indicates an outdated `rules_go` or `gazelle`. Upgrade to `rules_go` 0.65.0 and `gazelle` 0.54.0 or later, and check other rulesets for 9.x compatible releases.

## References

* [Cloudflare: eMudhra certificate compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/)
* [Patch tracker](https://emudhra.we-have-a-problem.com/)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.