eMudhra CA private keys are trivially guessable (CVE-2026-111943)

published 2026-10-22

Eight eMudhra CA private keys can be guessed in at most 256 tries, and one of them is just the number 4. An attacker who recovers them can sign content as if it came from the eMudhra certificate authority.

CVE: CVE-2026-111943

Source: aikido.dev

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1760 and your operating system.