rewindex

CompaniesRedpandaIncidents

Redpanda: CVE-2026-111943 (emudhra) Response

No impact listedStatus: resolvededitedStarted Resolved (7.8 h)3 updatesstatus.redpanda.com (opens in new tab)

Timeline of updates

  1. identifiedEdited

    We are responding internally to CVE-2026-111943 related to compromised root certificates.

    We have assessed Redpanda Cloud and have remediated any clusters secured with mTLS and have mitigated any other potential impacted vectors. We have also patched all Golang runtimes.

    We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless).

    For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed.

    For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.

  2. identified

    We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless).

    For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed.

    For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.

  3. resolvedEdited

    Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943: https://nvd.nist.gov/vuln/detail/cve-2026-111943 (opens in new tab).

    Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters.

    https://knowledgebase.redpanda.com/articles/1660912335-tsb-2026-44-self-hosted-emudhra-cve-2026-111943-response (opens in new tab): https://knowledgebase.redpanda.com/articles/1660912335-tsb-2026-44-self-hosted-emudhra-cve-2026-111943-response?preview=true (opens in new tab)

Changes Rewindex caught on this incident

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on status.redpanda.com (opens in new tab).

Redpanda profileRecent Redpanda incidentsMarkdownJSON