Loading vulnerability…
Compromised eMudhra CA certificate acceptance in CPython ssl
CVE-2026-115557 concerns continued acceptance of TLS certificate chains containing compromised eMudhra intermediate CA keys by CPython's ssl module. Attackers possessing these keys can issue certificates for arbitrary domains that remain acceptable while a trusted certification path exists and effective revocation or distrust checks are absent. Exposure includes cross-signed certificates and environments with outdated system or bundled trust stores. On Windows, Python's loading of the CA and ROOT stores without consulting the Disallowed store was reported to preserve an affected trust path. The fix introduces a denylist matching SHA-256 digests of certificate SubjectPublicKeyInfo structures, rejecting compromised keys even when reused in cross-signed certificates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Applications can accept attacker-issued certificates as valid, enabling TLS server impersonation and interception or modification of encrypted communications. Consequences include disclosure of credentials and sensitive data, manipulation of downloaded content, and disruption of dependent operations. Python-based package-management operations, including pip updates, can also be exposed when their TLS verification accepts an affected chain.
If you can’t patch tonight, do this now.
Ensure that application trust stores and certificate-validation mechanisms explicitly distrust the compromised intermediate keys across all certification paths, including cross-signed variants. Update operating-system, container, and bundled CA stores and configure effective certificate-revocation checking where supported. Operating-system distrust alone may be insufficient for Python applications using separate trust bundles or Windows certificate loading that does not consult the Disallowed store.
Patch, then assume compromise.
Upgrade to Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, or 3.11.18, or a later release containing the fix for the relevant branch. Alternatively, apply the corresponding CPython security patch. The fix rejects certificate chains containing denylisted intermediate public keys during certificate verification, without requiring separately configured revocation checking. Also update system and bundled trust stores; accompanying recommendations include pip 26.2.2, certifi 2026.10.19, and uv 0.13.4 or newer.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.