rewindex

ChangesAstronomerSecurity Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue

Astronomer: Incident updated: Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue

Incident updateNormal progress (rule, 100%)Changed status.astronomer.io (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Astronomer removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: identified
After: resolved
AddedResolved time#2
Before: not present
After: 2026-10-23 21:28 UTC
AddedUpdateresolved#3
Before: not present
After: We have now released updated agent client patches for use in Remote Execution deployments that incorporate certificate trust updates to mitigate the vulnerability. These are 1.8.11, 1.7.7, and 1.6.5. See more details in the Agent Release Notes: https://www.astronomer.io/docs/runtime/runtime-release-feed. Additionally, we have released another update of the Runtime images to handle the following two changes related to this vulnerability. • New virtual environments created with python -m venv now get pip 26.2.2 • Upgrade grpcio to 1.84.1, whose bundled CA list no longer includes the roots affected by the eMudhra compromise The following Runtime image versions include these changes. For more details see Runtime Release Notes: https://www.astronomer.io/docs/runtime/runtime-release-feed. • Runtime 13: 13.12.2 • Runtime 3.0: 3.0-21 • Runtime 3.1: 3.1-24 • Runtime 3.2: 3.2-13 • Runtime 3.3: 3.3-11

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Friday, October 23

1 incident change

Cite this

Incident updated: Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue on Astronomer’s status page, changed 2026-10-23 21:33 UTC (change 1 of 1).

Title
Incident updated: Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue
Vendor
Astronomer
Date
URL
https://rewindex.com/change/rc240045037a25d

All Astronomer changesAstronomer profileMarkdownJSON