# Handling of eMudhra CA compromise (CVE-2026-91403) local Elastic **URL:** \ **Category:** Elasticsearch\ **Created:** [October 23, 2026, 9:23am UTC](https://discuss.elastic.co/t/handling-of-emudhra-ca-compromise-cve-2026-91403-local-elastic/391128 "2026-10-23T09:23:35Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![john90](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@john90](https://discuss.elastic.co/u/john90)\ **Post date:** [October 23, 2026, 9:23am UTC](https://discuss.elastic.co/t/handling-of-emudhra-ca-compromise-cve-2026-91403-local-elastic/391128/1 "2026-10-23T09:23:35Z")
Hi, can find any thread about how users are handling this vulnerability in Java (that is delivered with Elasticsearch tar file distribution). Is it a non-issue for plain Elasticsearch service? We use v8, vulnerable cert exists in certificate store: ```auto ./jdk/bin/keytool -list -cacerts -storepass x | grep "D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4" Certificate fingerprint (SHA-256): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4 ``` ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [October 23, 2026, 10:02am UTC](https://discuss.elastic.co/t/handling-of-emudhra-ca-compromise-cve-2026-91403-local-elastic/391128/2 "2026-10-23T10:02:02Z")
In general we can't comment on security issues here in public, outside of the usual [Security Advisory](https://discuss.elastic.co/c/announcements/security-announcements/31) announcements. We're aware of this issue and will make an announcement as soon as we can. However, it may be of use to you to know that there's a [page on the OpenJDK site](https://openjdk.org/groups/vulnerability/advisories/2026-10-21) on this subject.