Go Blocks Trust in Compromised eMudhra Intermediate CAs Under CVE-2026-111943, and Cilium, Terraform and OpenTofu Ship Releases

Overview

Go 1.26.10, which the Go project lists as released on 2026-10-19, blocks trust in a small set of intermediate certificates. The Go issue for CVE-2026-111943 says the change is made “due to specific security concerns around their operation” and that Verify “will now filter out chains which contain these intermediates.” Several infrastructure projects written in Go have since shipped releases built on the fixed toolchain, including Cilium, Terraform and OpenTofu.

What the Go Project Said

The issue opens with the line “We’re blocking trust in a small set of intermediate certificates due to specific security concerns around their operation,” and adds: “We highly recommend immediately upgrading to this release.” The Go release history says go1.26.10 “includes security fixes to the crypto/x509 package” and does not name the certificate authority. The issue title, “crypto/x509: mitigation for security concerns with a specific Certificate Authority,” does not name it either.

The name appears in downstream release notes. The Cilium v1.20.4 notes describe an out-of-band security patch release that “upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted.” The Go issue thread also contains a comment from one participant listing certificates with eMudhra subject names, and another from a participant who says they were revoked “due to cACompromise on Oct 18-19”. Those two comments come from participants in the thread, and the Herald has not checked the underlying certificate records.

Downstream Releases

• Cilium. The v1.20.4, v1.19.10 and v1.18.16 releases all carry the same security note for CVE-2026-111943. According to the GitHub release metadata, all three were published on October 23.
• Terraform. The v1.16.7 release is dated October 22, 2026 and states: “Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943).” The v1.17.0 release, dated October 21, 2026, carries the same note. The pull request that bumped Go says: “We usually don’t include Go version bumps in the changelog, but I’ve added a note for all versions as this CVE will probably cause some disruption.”
• OpenTofu. The v1.13.2 release lists “Filter out compromised intermediate certificates” under security advisories, and the v1.12.9 release lists the same entry. Both were published on October 21, according to GitHub release metadata.

Why the Fix Lives in the Go Library

The thread includes pushback. A commenter named Drugoy wrote: “Such extra filtering isn’t a job for a programming language’s standard package / lib.” FiloSottile replied in the same thread: “This is not a policy decision based on how well the CA writes their CPS, the keys are compromised and their certificates revoked.” FiloSottile added that “the revocation of these intermediates has no way to propagate to applications, short of hardcoding them in code like this,” and that “We’ll be investing in less ad-hoc solutions for the future, but that requires large-scale ecosystem coordination, so it won’t be quick.”

A separate comment from rolandshoemaker explains the sparse wording of the release note: “We were made aware of the underlying issue here yesterday (Monday),” and “we were purposefully somewhat vague as to what the security issue we were fixing was, in order to not give attackers a headstart.” The same comment says the Go team’s priority was “to release a safe Go version as quickly as possible.”

What We Don’t Know

• The Go issue and release notes do not describe how the eMudhra keys were compromised, and the Herald found no primary statement from eMudhra in the sources reviewed.
• The sources reviewed do not say which other Go-built tools are affected. A commenter in the thread points to a third-party tracker of potentially impacted tools, which the Herald has not reviewed.
• Whether further Cilium, Terraform or OpenTofu release lines receive the same fix is not stated in the release notes cited here.

Operators running Go-built binaries should check the release notes of the specific tools they deploy, since a binary built on an earlier Go toolchain does not carry the filter.