Handling of eMudhra CA compromise (CVE-2026-91403) local Elastic

Elastic Stack Elasticsearch
1

Hi, can find any thread about how users are handling this vulnerability in Java (that is delivered with Elasticsearch tar file distribution).

Is it a non-issue for plain Elasticsearch service?

We use v8, vulnerable cert exists in certificate store:

./jdk/bin/keytool -list -cacerts -storepass x | grep "D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4"
Certificate fingerprint (SHA-256): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4
2

In general we can't comment on security issues here in public, outside of the usual Security Advisory announcements. We're aware of this issue and will make an announcement as soon as we can.

However, it may be of use to you to know that there's a page on the OpenJDK site on this subject.

3

Posting my findings as a user, so no guarantees whatsoever. This is a test to see if you are affected:

cat << 'EOF' > /tmp/CheckTrustAAA.java
import java.net.URI;
import javax.net.ssl.SSLHandshakeException;

public class CheckTrustAAA {
    public static void main(String[] args) {
        String target = "https://dv-g3b-aaa-emudhra.we-have-a-problem.com/";
        try {
            var conn = URI.create(target).toURL().openConnection();
            conn.setConnectTimeout(5000);
            conn.setReadTimeout(5000);
            conn.getInputStream().close();
            System.out.println("\n[!] VULNERABLE: Handshake succeeded via cross-signed root.\n");
        } catch (SSLHandshakeException e) {
            System.out.println("\n[+] SAFE: TLS handshake rejected (" + e.getMessage() + ")\n");
        } catch (Exception e) {
            System.out.println("\n[?] Error: " + e.getMessage() + "\n");
        }
    }
}
EOF

/usr/local/elasticsearch/jdk/bin/java /tmp/CheckTrustAAA.java
rm -f /tmp/CheckTrustAAA.java

Make sure this reports as VULNERABLE before config change.

There are multiple ways to mitigate this, but we will be adding vulnerable certs to blocked list in the Java distribution the Elasticsearch brings with it (/usr/local/elasticsearch/jdk/lib/security/blocked.certs). The vulnerable hashes:

default['elasticsearch']['jdk']['additional_blocked_certs'] = [
  # Issued by emSign Root TLS CA - G3
  'E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838', # EM EV TLS CA - G3B
  '98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B', # EM OV TLS CA - G3B
  '42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493', # EM DV TLS CA - G3B
  '432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3', # EM EV TLS CA - G3C
  'CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F', # EM OV TLS CA - G3C
  '0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19', # EM DV TLS CA - G3C
  # Issued by emSign Root CS CA - G3
  '9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4', # EM OV CS CA - G3B
  '4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1', # EM OV CS CA - G3C
  # Cross-signed by Sectigo AAA Certificate Services
  '579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512', # EM EV TLS CA - G3B
  '5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699', # EM OV TLS CA - G3B
  '45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE', # EM DV TLS CA - G3B
  'FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F', # EM EV TLS CA - G3C
  '7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489', # EM OV TLS CA - G3C
  '62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72', # EM DV TLS CA - G3C
  'A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8', # EM OV CS CA - G3B
  '84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD', # EM OV CS CA - G3C
]

After adding these hashes will make the above script fail with reject. Elasticsearch restart is needed.