Handling of eMudhra CA compromise (CVE-2026-91403) local Elastic

Elastic Stack Elasticsearch
1

Hi, can find any thread about how users are handling this vulnerability in Java (that is delivered with Elasticsearch tar file distribution).

Is it a non-issue for plain Elasticsearch service?

We use v8, vulnerable cert exists in certificate store:

./jdk/bin/keytool -list -cacerts -storepass x | grep "D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4"
Certificate fingerprint (SHA-256): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4
2

In general we can't comment on security issues here in public, outside of the usual Security Advisory announcements. We're aware of this issue and will make an announcement as soon as we can.

However, it may be of use to you to know that there's a page on the OpenJDK site on this subject.