EnterProtect eMudhra Certificate Compromise: Google Cloud Trust Store Fallout

What Happened

This EnterProtect eMudhra certificate compromise advisory starts with a report Google received on October 17, 2026. A security researcher told Google that private keys tied to eight eMudhra subordinate Certification Authority (CA) certificates, including ones cross-signed by AAA Certificate Services, were compromised. Google says those certificates are no longer trusted and are being revoked.

Google says its own infrastructure is not compromised and that security telemetry shows no evidence of exploitation against Google Cloud workloads. Mitigations are in place across Google-managed environments to block and distrust the affected CA certificates.

The risk sits with connections you or your clients manage. Google's Apigee bulletin GCP-2026-077 says outbound TLS connections trusting affected roots, specifically emSign ECC Root CA - G3, are vulnerable to man-in-the-middle interception. An attacker with a compromised intermediate key can issue fraudulent TLS certificates for arbitrary domain names. If an application accepts one, traffic can be read or changed.

Timeline

The published record runs from the key generation error to the advisory updates.

1. April 2025: Cisco's advisory says an unprecedented error in eMudhra's Key Generation Ceremony (KGC) left the private keys for eight intermediate certificates fundamentally broken.
2. October 17, 2026: Google receives a report from a security researcher about the compromise of private keys for eight eMudhra subordinate CA certificates.
3. Between October 17 and October 20, 2026: Cisco says the critical security compromise involving eMudhra-managed Certificate Authorities was uncovered.
4. October 23, 2026: Google publishes bulletin GCP-2026-071.
5. October 28, 2026: Google adds Managed Service for Apache Spark and Cloud Profiler to the affected products list.
6. November 2, 2026: Google publishes bulletin GCP-2026-075 and adds Google Cloud SDK Libraries to the affected products list.
7. November 3, 2026: Google publishes bulletin GCP-2026-077 with Apigee remediation steps.
8. November 10, 2026: Cisco publishes its informational advisory on the emergency distrust of eMudhra root and intermediate certificate authorities.
9. November 11, 2026: Hacker News reports eMudhra revoked 8 more CAs it previously declared unaffected; BleepingComputer reports eight additional intermediate CA certificates revoked.

Who Is Affected

Google's affected list covers the certificates and the cloud products that use them. MSPs should treat this as a platform and language dependency issue, not a single product patch.

• Eight eMudhra subordinate Certification Authority (CA) certificates, including those cross-signed by AAA Certificate Services
• emSign ECC Root CA - G3
• emSign Root TLS CA - G3
• Google Cloud CLI
• Cloud Shell
• Container-Optimized OS
• Compute Engine
• Google Kubernetes Engine
• Vertex AI
• Colab Enterprise
• App Engine
• Cloud Run
• Cloud Run functions
• Cloud Functions for Firebase

EnterProtect eMudhra Certificate Compromise: What It Means for MSPs

For an MSP, the cost of this incident is not the revocation. It is the client application that fails certificate validation or keeps accepting a forged certificate because its trust store still trusts the affected root. That is a man-in-the-middle window. Any outbound TLS connection from an affected runtime using a default or unmanaged trust store can accept a certificate an attacker should not present. You carry that risk when you manage the operating system, container image, or language runtime. Google says it sees no exploitation against Google Cloud workloads. Self-managed environments and custom images are yours to check, because the trust store lives with you.

Technical Details

The CVEs are CVE-2026-111943 and CVE-2026-91403, rated medium in Google's bulletin. GCP-2026-077 names Apigee, Apigee Hybrid, Apigee Edge (SaaS), and Apigee Edge for Private Cloud (OPDK) as affected products.

The attack vector Google describes: an attacker possessing compromised intermediate keys can issue fraudulent TLS certificates for arbitrary domain names. Outbound TLS connections trusting affected roots, specifically emSign ECC Root CA - G3, are vulnerable to man-in-the-middle interception. Outbound HTTPS connections from Apigee runtimes (such as TargetEndpoints, TargetServers, ServiceCallouts, and outbound JWKS policy lookups) using default or unmanaged system trust stores may accept forged certificates.

Versions from GCP-2026-075: Python certifi earlier than 2026.10.19 (REST transports); httplib2 earlier than 0.32.1, used by google-api-python-client and google-auth-httplib2; grpcio earlier than 1.84.1 (gRPC transports). In Java, com.google.api-client: google-api-client before 2.9.2 is the one exception that bundles CA certificates.

What MSPs Should Do

Start with the environments you manage directly. Google says its own infrastructure is not breached and telemetry shows no exploitation against Google Cloud workloads. The trust store fix is still needed wherever you own the operating system, container image, or language runtime.

1. If you manage operating systems or custom container images on Compute Engine, Google Kubernetes Engine (GKE), or Cloud Run, update the trust store.
2. For Python, upgrade certifi to 2026.10.19 or later.
3. Upgrade httplib2 to 0.32.1 or later.
4. Upgrade grpcio to 1.84.1 or later.
5. Rebuild and redeploy container images after the package updates.
6. For Java, upgrade the Google client libraries to pull in the fix, or update com.google.api-client: google-api-client so it is no longer before 2.9.2.
7. As a standing practice, inventory which client applications use a default or unmanaged system trust store for outbound TLS, and prioritize internet-facing services.
8. Test certificate validation after updates before you push to production.

How EnterProtect Helps

EnterProtect backup keeps clean restorable copies of client systems. If a trust store problem or any other incident forces a rebuild, you have a recovery point to work from. EnterProtect recovery gets a client running again. EnterProtect vulnerability scanning finds exposed versions across client environments as a standing practice.

Frequently Asked Questions

What Is the eMudhra CA Certificate Compromise?

Google received a report on October 17, 2026 that private keys for eight eMudhra subordinate CA certificates, including ones cross-signed by AAA Certificate Services, were compromised. Google says those certificates are no longer trusted and are being revoked. Google also says its own infrastructure is not compromised and that telemetry shows no evidence of exploitation against Google Cloud workloads.

Which Google Cloud Products Are Affected?

Google's bulletin lists Google Cloud CLI, Cloud Shell, Container-Optimized OS, Compute Engine, Google Kubernetes Engine, Vertex AI, Colab Enterprise, App Engine, Cloud Run, Cloud Run functions, Cloud Functions for Firebase, Firebase App Hosting, Cloud SQL, AlloyDB for PostgreSQL, Firestore, Firebase App Distribution, Cloud Monitoring, Confidential Space, Google Distributed Cloud, Managed Service for Apache Spark, Cloud Profiler, and Google Cloud SDK Libraries. Apigee, Apigee Hybrid, Apigee Edge (SaaS), and Apigee Edge for Private Cloud (OPDK) appear in a separate bulletin. Base images and client SDKs are also affected.

What Is the Attack Vector for CVE-2026-111943 and CVE-2026-91403?

Google says an attacker possessing compromised intermediate keys can issue fraudulent TLS certificates for arbitrary domain names. Outbound TLS connections trusting affected roots, specifically emSign ECC Root CA - G3, are vulnerable to man-in-the-middle interception. Outbound HTTPS connections from Apigee runtimes using default or unmanaged system trust stores may accept forged certificates.

Which Python Package Versions Fix the Issue?

Google's bulletin says to upgrade certifi to 2026.10.19 or later, httplib2 to 0.32.1 or later, and grpcio to 1.84.1 or later. After the upgrades, rebuild and redeploy your container images. In Java, the affected client library is com.google.api-client: google-api-client before 2.9.2.

Is This Being Exploited in the Wild?

Google says security telemetry shows no evidence of exploitation against Google Cloud workloads. Cisco's advisory says the private keys were fundamentally broken due to an error in the Key Generation Ceremony in April 2025 and could be brute-forced within seconds. The sources do not report a confirmed campaign.

Sources

• Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities (Cisco Psirt)
• eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise (Hackernews)
• eMudhra revokes 8 more CA certificates after private key mishap (Bleepingcomputer)
• GCP-2026-071 (Google Cloud Security Corrected)
• GCP-2026-077 (Google Cloud Security Corrected)
• GCP-2026-075 (Google Cloud Security Corrected)