TRY NOW
book meeting
BACK TO KB LIST

Mitigating Impact of Compromised eMudhra Intermediate CA Certificates on Veeam Kasten for Kubernetes

KB ID: 4954
Product: Veeam Kasten for Kubernetes
Published: 2026-10-22
Last Modified: 2026-10-22
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Summary

Issue Summary

In October 2026, eMudhra revoked eight intermediate certificate authority (CA) certificates because their private keys could be recovered. Until these intermediates are blocked, anyone holding a recovered key can issue certificates that TLS clients trust. In Go programs, this issue is tracked as CVE-2026-111943, which Red Hat rates Important (CVSS 6.8). According to eMudhra's statement on the incident, none of the affected intermediates issued any certificates, and eMudhra is not aware of any evidence that the weak keys were exploited before the issue was disclosed.

How This Impacts Veeam Kasten for Kubernetes

Veeam Kasten for Kubernetes 9.0.8 and earlier versions trust certificates issued from the compromised eMudhra intermediate CAs. Veeam Kasten for Kubernetes components use TLS to connect to the following external endpoints:

  • Object storage and cloud provider storage APIs
  • OIDC and LDAPS identity providers
  • Veeam Backup & Replication
  • Veeam Data Cloud Vault
  • Cloud marketplace metering APIs
  • The Kasten telemetry service
  • The public Kasten Helm chart index (used for update notifications)

An attacker who can intercept that traffic could impersonate one of these endpoints without causing a certificate error.

Veeam Kasten for Kubernetes verifies certificates against the trust store inside its containers. Updating the operating system of the Kubernetes nodes does not change that trust store, so the issue is resolved only by upgrading Veeam Kasten for Kubernetes.

How Veeam Kasten for Kubernetes 9.0.9 Addresses the Issue

Veeam Kasten for Kubernetes 9.0.9 addresses this issue in two ways:

  • Go 1.27.3: All Go-based Veeam Kasten for Kubernetes services are rebuilt with Go 1.27.3, which adds a denylist to the Go crypto/x509 package that rejects the compromised intermediates.
  • Container trust store: In the Red Hat UBI base images, the emSign ECC Root CA - G3 certificate is added to the trust store blocklist. As a precaution, the Comodo AAA Services root certificate is also blocklisted.

Earlier versions must be upgraded to Veeam Kasten for Kubernetes 9.0.9 or later.

Affected Versions

All Veeam Kasten for Kubernetes versions earlier than 9.0.9 are affected.

Version Go Toolchain in Services emSign ECC Root CA - G3 in Container Trust Store Status
9.0.9 and later Go 1.27.3 Blocklisted Not affected
9.0.8 and earlier Go 1.27.2 or earlier Trusted Affected
Swipe to show more of the table

This applies to every Veeam Kasten for Kubernetes image built from the Veeam Kasten for Kubernetes UBI base images, including the bundled Dex, Prometheus, and configmap-reload images. The Veeam Kasten for Kubernetes dashboard frontend consists of static files that run in the browser, so it is not affected.

Red Hat Status

At the time of publishing this article, Red Hat tracks CVE-2026-111943 only against Go-based packages, and no ca-certificates update for RHEL or UBI removes the affected roots. For this reason, Veeam Kasten for Kubernetes blocklists these roots in its images.

Node Operating System Updates

Ubuntu and Debian have released ca-certificates updates that blocklist these roots. These updates protect software running on the Kubernetes nodes but do not change the trust store inside Veeam Kasten for Kubernetes containers.

Solution

Upgrade to Veeam Kasten for Kubernetes 9.0.9 or later. No workaround is available for earlier versions, because the trust store is part of each container image. Do not modify the trust store in Veeam Kasten for Kubernetes containers manually.

Certificate Errors After Upgrade

After the upgrade, connections to endpoints whose certificates chain to emSign ECC Root CA - G3 or AAA Certificate Services may fail with TLS or certificate trust errors. This is expected. Ask the owner of the endpoint to replace the certificate with one issued by another CA.

Helm Installations

  1. Update the Kasten Helm repository:
helm repo update kasten
  1. Upgrade Veeam Kasten for Kubernetes, keeping your existing values:
helm upgrade k10 kasten/k10 --namespace=kasten-io --reuse-values --version=9.0.9

Red Hat OpenShift Operator Installations

In the OpenShift web console, update the Veeam Kasten operator to 9.0.9 from Operators > Installed Operators. Operators set to Automatic approval are updated without further action.

Air-Gapped Installations

Mirror the Veeam Kasten for Kubernetes 9.0.9 images to your private registry before upgrading. To list the images, run the following command:

docker run --rm gcr.io/kasten-images/k10offline:9.0.9 list-images

Then run the Helm upgrade command described above, using your existing global.airgapped.repository value.

Custom CA Certificates

Veeam Kasten for Kubernetes trusts any certificates supplied through the cacertconfigmap.name Helm value, in addition to its built-in trust store. Make sure that this ConfigMap does not contain emSign ECC Root CA - G3 or the compromised eMudhra intermediates. Go 1.27.3 rejects the compromised intermediates even if the root is added back, but other trust paths through that root would be restored.

Verify the Fix

Run the following checks after the upgrade. The commands use the default kasten-io namespace. If Veeam Kasten for Kubernetes is installed in a different namespace, change it in each command.

Check 1: Confirm That All Pods Run 9.0.9 Images

kubectl get pods -n kasten-io \
  -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u

Every Veeam Kasten for Kubernetes image must have the tag 9.0.9 or later. If an image still shows an older tag, its pod has not been replaced yet. Run kubectl get pods -n kasten-io to find pods that are not in the Running state.

Check 2: Confirm That the Trust Store Excludes the Root

Run the following command:

for d in $(kubectl get deploy -n kasten-io -o name); do
  printf '%s: ' "$d"
  kubectl exec -n kasten-io "$d" -- \
    grep -c 'emSign ECC Root CA - G3' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
done

Each deployment must print 0. To view the blocklist entries in a single service, run the following command:

kubectl exec -n kasten-io deploy/catalog-svc -- ls /etc/pki/ca-trust/source/blocklist

The output must include emSign_ECC_Root_CA_-_G3.pem and Comodo_AAA_Services_root.pem.

Check 3 (Optional): Confirm the Go Version of a Service Binary

This check runs on a workstation with Docker and Go installed. It pulls an image and reports the Go version that each binary was built with:

mkdir k10-check
docker export "$(docker create --platform=linux/amd64 gcr.io/kasten-images/dashboardbff:9.0.9)" | tar -x -C k10-check
go version k10-check

The service binary must report go1.27.3 or later. To check additional services, repeat the check with other image names.

Vulnerability Scanners

At the time of publishing this article, vulnerability scanner databases record CVE-2026-111943 only against operating system packages, and not against the Go standard library in compiled binaries. Scanners therefore might not report it for Veeam Kasten for Kubernetes images, including affected images. Use the checks above instead.

More Information

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.