AWS Directs Trust-Bundle Updates After eMudhra Key Compromise
Tech GuruQuick Answer
AWS bulletin 2026-150-AWS addresses CVE-2026-111943 across AWS trust-bundle consumers. Inventory listed services and components, update botocore, Amazon Linux and Corretto, apply the Bottlerocket interim control where needed, replace affected certificate chains, validate TLS workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory the AWS services, hosts, SDKs, container and node images, Java runtimes, trust stores, origin and identity-provider certificates, owners, and deployment pipelines covered by bulletin 2026-150-AWS. Match each environment to AWS's product-specific matrix and inspect the trust store or certificate chain actually in use. Do not infer exposure from general AWS use, and do not treat a managed-service rollout as proof that every customer-managed image or dependency is current. Update botocore to 1.43.117 or later, install current Amazon Linux ca-certificates packages, move to current Corretto releases, apply AWS's Bottlerocket interim trust override where applicable until updated AMIs are available, replace affected origin or identity-provider certificate chains by the stated deadlines, and follow the remaining service-specific rollout guidance. Confirm package, SDK, runtime, AMI and trust-store state; rebuild immutable images where needed; test CloudFront origins, OIDC and JWT identity providers, TLS clients, workloads and fail-closed revocation behavior; track AWS Health and service rollout status; and retain commands, versions, test results and change records.
Last verified: 2026-10-25 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | AWS services and customer-managed AWS components that rely on affected eMudhra or AAA certificate-authority roots |
|---|---|
| Advisory | 2026-150-AWS |
| CVE | CVE-2026-111943 |
| Authoritative release date | 2026-10-25 03:00:00 UTC |
| Authority revision date | 2026-10-25 03:05:54 UTC |
| Affected versions | AWS's listed trust-bundle consumers, including customer-managed Amazon Linux 2 and 2023 systems, botocore before 1.43.117, Bottlerocket AMIs at or below 1.67.0, and certificate-dependent CloudFront, Application Load Balancer, Corretto, EMR, and related service paths described in bulletin 2026-150-AWS. |
| Fixed version | Botocore 1.43.117 or later, current Amazon Linux ca-certificates packages, current Corretto releases, the Bottlerocket interim trust override until updated AMIs arrive, and AWS's documented service-specific trust-store rollout |
| CVSS base score | 6.8 (CVSS v3) |
| CVSS severity | Medium |
| Exploitation status | AWS does not state that malicious exploitation has been observed. It says clients that enforce OCSP or CRL checking fail-closed are not affected because the intermediates and cross-signs were revoked.; no exploitation claim is inferred. |
What Changed
AWS published product-specific action after private keys for eight eMudhra intermediate certificate authorities became recoverable, creating a forged-certificate risk where affected trust paths remain accepted.
What To Validate Now
- Inventory. Inventory the AWS services, hosts, SDKs, container and node images, Java runtimes, trust stores, origin and identity-provider certificates, owners, and deployment pipelines covered by bulletin 2026-150-AWS.
- Establish applicability. Match each environment to AWS's product-specific matrix and inspect the trust store or certificate chain actually in use. Do not infer exposure from general AWS use, and do not treat a managed-service rollout as proof that every customer-managed image or dependency is current.
- Remediate. Update botocore to 1.43.117 or later, install current Amazon Linux ca-certificates packages, move to current Corretto releases, apply AWS's Bottlerocket interim trust override where applicable until updated AMIs are available, replace affected origin or identity-provider certificate chains by the stated deadlines, and follow the remaining service-specific rollout guidance.
- Validate. Confirm package, SDK, runtime, AMI and trust-store state; rebuild immutable images where needed; test CloudFront origins, OIDC and JWT identity providers, TLS clients, workloads and fail-closed revocation behavior; track AWS Health and service rollout status; and retain commands, versions, test results and change records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Trust removal can break TLS paths that still chain to the affected roots. Coordinate certificate replacement and application testing before deadlines, distinguish customer-managed work from AWS-managed rollouts, and do not present revocation support as universal unless fail-closed checking was verified.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
