Mitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes
| KB ID: | 4954 |
| Product: | Veeam Kasten for Kubernetes |
| Published: | 2026-10-22 |
| Last Modified: | 2026-10-22 |
Oops! Something went wrong.
Please, try again later.
Summary
Issue Summary
In October 2026, eMudhra revoked eight intermediate certificate authority (CA) certificates because their private keys could be recovered. Until these intermediates are blocked, anyone holding a recovered key can issue certificates that TLS clients trust. In Go programs, this issue is tracked as CVE-2026-111943, which Red Hat rates Important (CVSS 6.8). According to eMudhra's statement on the incident, none of the affected intermediates issued any certificates, and eMudhra is not aware of any evidence that the weak keys were exploited before the issue was disclosed.
How This Impacts Veeam Kasten for Kubernetes
Veeam Kasten for Kubernetes 9.0.8 and earlier versions trust certificates issued from the compromised eMudhra intermediate CAs. Veeam Kasten for Kubernetes components use TLS to connect to the following external endpoints:
- Object storage and cloud provider storage APIs
- OIDC and LDAPS identity providers
- Veeam Backup & Replication
- Veeam Data Cloud Vault
- Cloud marketplace metering APIs
- The Kasten telemetry service
- The public Kasten Helm chart index (used for update notifications)
An attacker who can intercept that traffic could impersonate one of these endpoints without causing a certificate error.
Veeam Kasten for Kubernetes verifies certificates against the trust store inside its containers. Updating the operating system of the Kubernetes nodes does not change that trust store, so the issue is resolved only by upgrading Veeam Kasten for Kubernetes.
How Veeam Kasten for Kubernetes 9.0.9 Addresses the Issue
Veeam Kasten for Kubernetes 9.0.9 addresses this issue in two ways:
- Go 1.27.3: All Go-based Veeam Kasten for Kubernetes services are rebuilt with Go 1.27.3, which adds a denylist to the Go
crypto/x509package that rejects the compromised intermediates. - Container trust store: In the Red Hat UBI base images, the
emSign ECC Root CA - G3certificate is added to the trust store blocklist. As a precaution, theComodo AAA Services rootcertificate is also blocklisted.
Earlier versions must be upgraded to Veeam Kasten for Kubernetes 9.0.9 or later.
Affected Versions
All Veeam Kasten for Kubernetes versions earlier than 9.0.9 are affected.
| Version | Go Toolchain in Services | emSign ECC Root CA - G3 in Container Trust Store | Status |
| 9.0.9 and later | Go 1.27.3 | Blocklisted | Not affected |
| 9.0.8 and earlier | Go 1.27.2 or earlier | Trusted | Affected |
This applies to every Veeam Kasten for Kubernetes image built from the Veeam Kasten for Kubernetes UBI base images, including the bundled Dex, Prometheus, and configmap-reload images. The Veeam Kasten for Kubernetes dashboard frontend consists of static files that run in the browser, so it is not affected.
Red Hat Status
At the time of publishing this article, Red Hat tracks CVE-2026-111943 only against Go-based packages, and no ca-certificates update for RHEL or UBI removes the affected roots. For this reason, Veeam Kasten for Kubernetes blocklists these roots in its images.
Node Operating System Updates
Ubuntu and Debian have released ca-certificates updates that blocklist these roots. These updates protect software running on the Kubernetes nodes but do not change the trust store inside Veeam Kasten for Kubernetes containers.
Solution
Upgrade to Veeam Kasten for Kubernetes 9.0.9 or later. No workaround is available for earlier versions, because the trust store is part of each container image. Do not modify the trust store in Veeam Kasten for Kubernetes containers manually.
After the upgrade, connections to endpoints whose certificates chain to emSign ECC Root CA - G3 or AAA Certificate Services may fail with TLS or certificate trust errors. This is expected. Ask the owner of the endpoint to replace the certificate with one issued by another CA.
Helm Installations
- Update the Kasten Helm repository:
- Upgrade Veeam Kasten for Kubernetes, keeping your existing values:
Red Hat OpenShift Operator Installations
In the OpenShift web console, update the Veeam Kasten operator to 9.0.9 from Operators > Installed Operators. Operators set to Automatic approval are updated without further action.
Air-Gapped Installations
Mirror the Veeam Kasten for Kubernetes 9.0.9 images to your private registry before upgrading. To list the images, run the following command:
Then run the Helm upgrade command described above, using your existing global.airgapped.repository value.
Custom CA Certificates
Veeam Kasten for Kubernetes trusts any certificates supplied through the cacertconfigmap.name Helm value, in addition to its built-in trust store. Make sure that this ConfigMap does not contain emSign ECC Root CA - G3 or the compromised eMudhra intermediates. Go 1.27.3 rejects the compromised intermediates even if the root is added back, but other trust paths through that root would be restored.
Verify the Fix
Run the following checks after the upgrade. The commands use the default kasten-io namespace. If Veeam Kasten for Kubernetes is installed in a different namespace, change it in each command.
Check 1: Confirm That All Pods Run 9.0.9 Images
Every Veeam Kasten for Kubernetes image must have the tag 9.0.9 or later. If an image still shows an older tag, its pod has not been replaced yet. Run kubectl get pods -n kasten-io to find pods that are not in the Running state.
Check 2: Confirm That the Trust Store Excludes the Root
Run the following command:
Each deployment must print 0. To view the blocklist entries in a single service, run the following command:
The output must include emSign_ECC_Root_CA_-_G3.pem and Comodo_AAA_Services_root.pem.
Check 3 (Optional): Confirm the Go Version of a Service Binary
This check runs on a workstation with Docker and Go installed. It pulls an image and reports the Go version that each binary was built with:
The service binary must report go1.27.3 or later. To check additional services, repeat the check with other image names.
Vulnerability Scanners
At the time of publishing this article, vulnerability scanner databases record CVE-2026-111943 only against operating system packages, and not against the Go standard library in compiled binaries. Scanners therefore might not report it for Veeam Kasten for Kubernetes images, including affected images. Use the checks above instead.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
