eMudhra/emSign CA compromise (October 2026): what Cloud SDK Rust Libraries developers need to do #7359

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

• rustls-webpki earlier than 0.103.16 (RUSTSEC-2026-0382).
• webpki-root-certs earlier than 1.0.10 (RUSTSEC-2026-0383), or webpki-roots earlier than 1.0.10 (RUSTSEC-2026-0381), whichever root store crate your build uses.
• The operating system's trust store, for builds that use it instead of a root store crate.

You can take the following actions to resolve these issues

• Run cargo update, then rebuild and redeploy.
• Apply operating system updates if your build uses the operating system's trust store.

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.