GHSA-6q48-6c7w-9gw2: certifi bundles emSign root CAs with compromised intermediate CA keys

certifi is the CA bundle behind requests, urllib3 and pip, and the Python.org macOS installer. Clients that trust it accept any certificate chaining to a bundled root. The compromised intermediates chain to the emSign ECC G3 root, so a certificate signed with one of those keys passes validation for any hostname, such as a package index or API host.

The attacker needs the leaked key and a network position between client and server, for example on shared Wi-Fi or in a compromised network path. That is why the vector rates complexity high. They can then read or change traffic, including credentials, tokens and downloaded packages. Revoking the intermediates helps only if clients check revocation, and Python clients do not do so by default.

Release 2026.10.18 removed all emSign roots. Release 2026.10.19 restored the emSign roots that are not affected.

Affected: certifi >= 2019.03.09 and < 2026.10.19. Containers, virtualenvs and vendored copies carry their own copy, as do applications that bundle certifi.

pip show certifi
python -c "import certifi; print(certifi.where())"

Search images and environments for other copies of certifi/cacert.pem. Anything older than 2026.10.19 still trusts the root.

Upgrade to certifi 2026.10.19 or later:

pip install --upgrade certifi

Rebuild container images that vendor certifi, and update lock files so installs do not resolve to an older version. Version 2026.10.18 removed all emSign roots, and 2026.10.19 restored the unaffected ones, so 2026.10.19 is the target. The Python discussion thread on the eMudhra incident covers guidance for Python users, and the sources list no other workaround.

Check which certifi version each environment and image uses. To see whether the bundle still contains the root, search certifi/cacert.pem for the label emSign ECC Root CA - G3. In TLS logs or packet captures, look for server certificates issued by an eMudhra or emSign intermediate for hosts that normally use another CA.

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.

An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.

Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.