← Back to changelog

2026-10-26

Cluster add-ons stop trusting the compromised eMudhra CA certificates

#add-on  #kubernetes  #security  #update  #upgrade  #component  #eks 

Last week, the private keys of eight eMudhra intermediate certificate authorities were found to be compromised (CVE-2026-111943). Anyone holding them can issue TLS certificates that look valid. Browsers and operating systems are removing eMudhra from their trusted certificates, and the projects behind our cluster add-ons are shipping rebuilt releases. We are rolling out a follow-up to the October add-on upgrades that picks them up. It is live on non-production clusters, and production follows.

What changed

  • Add-ons that make outgoing TLS connections no longer trust eMudhra. cert-manager, the AWS Load Balancer Controller, Dex, the blackbox exporter and the EBS CSI driver now run images without the compromised eMudhra certificates. This matters most for cert-manager, which talks to your ACME issuer and DNS provider, and for Dex, which talks to your login provider.
  • Other add-ons reject the compromised certificates as well. Alloy, Loki, Tempo, the Vertical Pod Autoscaler, Karpenter and the EKS node monitoring agent are rebuilt with a Go version that refuses certificates signed by the compromised intermediates, even when they are still in the image’s trust store.
  • A new node image. EKS node image v20261023 also blocks the compromised certificates. It replaces every node once, and Karpenter moves your workloads within your node pools’ disruption budgets, as in any node rotation.
  • Traefik 3.7.16 closes four security issues. If you route traffic with your own Gateway API HTTPRoutes, a backend on port 443 or on a port named https now needs appProtocol: https on its Service port to keep using HTTPS. Ingresses and IngressRoutes are not affected.
  • GPU node checks are stricter. The EKS node monitoring agent now also checks the NVIDIA driver and Fabric Manager. On GPU clusters, a node with a hung driver is now flagged as unhealthy and replaced, where it used to keep running.

What you need to do

Nothing for the add-ons we manage. Your own applications are a different story: an image built before last week most likely still trusts the eMudhra certificates. Rebuild your images on an up-to-date base image (Alpine ca-certificates 20261020 or newer, or a recent distroless or Debian image), and move Go services to Go 1.26.10 or 1.27.3 or newer.

Add-on upgrades

We also picked up the latest EKS build revisions for CoreDNS, kube-proxy, metrics-server and the VPC CNI (packaging updates only, no version change).

Some add-ons have no release yet that drops the eMudhra certificates, among them Flux, KEDA, external-dns, fluent-bit and Velero. We upgrade them as soon as their maintainers publish one.