Plan
active
Envoy v1.39.6 patches compromised eMudhra CA from distroless image
- Platform/SRE — Plan: Envoy 1.39.5 shipped with the unpatched ca-certificates bundle that still trusts the compromised eMudhra intermediate CA roots, enabling potential MITM on TLS connections; upgrade Envoy distroless images to v1.39.6 this sprint — no hard external deadline, but exposure exists on any cluster running 1.39.5.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.