Compromised eMudhra Intermediate CA Certificates
The private keys for eight eMudhra intermediate certificate authorities were compromised. Software that trusts certificates issued through the affected chains may need an updated certificate truststore. See eMudhra’s incident updates.
Impact on Sonatype Products
Sonatype is preparing updated Docker images and patch releases with updated trusted certificate data. Existing Docker images and bundled JVMs do not receive these updates automatically.
Consult the table below for impacted Sonatype products and versions:
Self-Hosted Solutions
Product | Impacted Versions | Fixed Version(s) | Download |
|---|---|---|---|
Sonatype Nexus Repository | 3.97.1 and earlier |
|
|
Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | 208 and earlier |
|
|
Sonatype Cloud Solutions
Product | Impacted? | Date Fixed |
|---|---|---|
Sonatype Nexus Repository | Yes | October 21, 2026 |
Sonatype IQ Server (Lifecycle, SBOM Manager, Firewall, Developer) | Yes | October 22, 2026 |
Sonatype Firewall Pro | Yes | October 21, 2026 |
Sonatype Guide | Yes | October 22, 2026 |
What You Need to Do
For self-managed Sonatype deployments, install the applicable updated Docker image or patch release when Sonatype makes it available. For Sonatype’s latest trust and security updates, visit the Sonatype Trust Center Updates. We’ll post product-specific release details and instructions in Sonatype Guide Security Events.
Do not manually change a Sonatype product’s bundled JVM truststore unless Sonatype provides product-specific instructions. If those instructions call for a manual Java truststore change, see the SSL Certificate Guide for the procedure.
If you manage systems that use eMudhra-issued certificates with tools other than Sonatype Nexus Repository or Sonatype Lifecycle, contact your certificate provider to confirm whether your certificate chain is affected and whether you need a replacement. Do not bypass certificate validation warnings.