Certificate-Authority on CuraDevOps

Envoy v1.37.10: eMudhra CA compromise security patch

Mon, 26 Oct 2026 18:15:15 +0000

Platform/SRE — Plan: Removes trust for compromised eMudhra CA private keys from Envoy’s trust store; any 1.37.x deployment trusting those CAs is exposed to fraudulent cert acceptance. No KEV listing or confirmed active exploitation, so cap is Plan — schedule patching to 1.37.10 this sprint; 1.37 itself EOLs 2027-01-13.
CI/CD — Skip
Leader — Skip
Signals: Envoy 1.37 reaches EOL in 79d (2027-01-13)

Mon, 26 Oct 2026 18:15:15 +0000

Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
CI/CD — Skip
Leader — Skip
Signals: Envoy 1.38 EOL 2027-04-23

Mon, 26 Oct 2026 18:15:15 +0000

Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
CI/CD — Skip
Leader — Skip
Signals: Envoy 1.39 EOL 2027-07-14