No further actions required of customers to mitigate the risk from eMudhra within their Evervault deployed resources.

Customers should ensure that they followed our previous guidance to mitigate the threat where appropriate.

All deployed Functions have been upgraded to the latest runtime, and no longer trust the compromised certificate. This applies to Functions using any of the following runtimes:

• Node: 18, 20, 22, 24, 26

• Python: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14

Update: eMudhra certificate compromise
On 19 October 2026, the private keys for eight eMudhra intermediate certificates were found to be compromised. With these keys, an attacker can create a forged certificate for any domain. Evervault has updated its services so that they no longer trust these certificates. We have found no evidence that anyone exploited this issue against Evervault services.

Some customers must take action on Evervault components that they deploy or run. The actions for each product are below.

Relay and the Evervault API
Evervault has updated these services. No action is required.

Functions
Evervault is in the process of updating all deployed Functions so that they no longer trust the compromised certificates. [No redeploy is required.] This update applies to the certificate store of the Function runtime. It does not apply to certificates that your code or its dependencies include, for example the Python certifi package.

• Update the affected packages listed in the Python advisory.

• Make sure that your Functions use a current runtime: Node 22, 24 or 26, or Python [3.13 or 3.14].

• Redeploy your Functions.

SDKs
The Evervault SDKs use the certificate store of your language runtime and operating system. You do not need to update the SDKs. Make sure that your operating system certificate package (for example, ca-certificates) and your language runtime are up to date.

CLI
The Evervault CLI trusts your operating system's certificate store, so apply your OS's latest CA certificate update to stop trusting the compromised certificates. We still recommend moving to CLI 5.0.1: to do so, run ev update if you're on version 5, or curl https://cli.evervault.com/v5/install -sL | CLI_FORCE_INSTALL=1 sh if you're on version 4, since ev update won't cross a major version.

Enclaves

• Update the Enclave data plane to 1.4.2.

• If your Enclave uses network egress, update the certificate store in your Enclave base image and any certificate packages in your application.

• Rebuild and redeploy your Enclave.