Skip to main content
In October 2026, the private keys for eight intermediate certificate authorities (CAs) operated by eMudhra were compromised. Because these intermediates chain to widely trusted roots, an attacker could issue a certificate that any system that hasn’t been updated accepts as valid. See the eMudhra incident summary for details. The following Astro Runtime versions distrust the affected roots: Astro Runtime 12 and earlier are out of maintenance and don’t include the fix. If you run Astro Runtime 12 and can’t upgrade to Astro Runtime 13 yet, use this guide to apply the same mitigation to your own image. For Astro Runtime 11 and earlier, which use Debian 11 (bullseye), see the remediation steps from the eMudhra incident site.
Upgrading is the recommended fix. Use this guide only as a temporary measure until you can upgrade. See Upgrade Astro Runtime.

​
Affected root certificates

Distrust both of the following roots in your image:
  • emSign ECC Root CA - G3
  • Comodo AAA Services root
Distrusting these roots can break TLS connections to any endpoint whose certificate chain depends only on them, including some non-eMudhra services. Test your connections in a development Deployment before you deploy to production.

​
Step 1: Update the operating system in your Dockerfile

Add the following to your project’s Dockerfile, after the FROM line. Choose the tab that matches your image.
Upgrading all packages also picks up other security fixes that have been released since your Runtime version.
Replace <version> with your Astro Runtime version, such as 12.12.0. RHEL UBI images (-ubi9) are available for Astro Runtime 12.5 and later. See Operating system variant images. Both examples fail the build if either root is still trusted.

​
Step 2: Update Python packages that bundle CA lists

Python libraries such as requests use the certifi CA bundle instead of the operating system trust store. The pip, virtualenv, and uv packaging tools also bundle their own CA lists. Add the fixed versions to your requirements.txt file:
Astro Runtime 13 and 12 installs packages with pip and doesn’t include uv. Adding uv is safe.

​
Step 3: Check for custom CA bundles

If you set REQUESTS_CA_BUNDLE, SSL_CERT_FILE, or CURL_CA_BUNDLE to a custom CA bundle, remove the two roots from that bundle as well.

​
Step 4: Test and deploy

  1. Run astro dev restart to rebuild the image locally.
  2. Run a Dag that connects to your key external services to confirm that TLS connections still work.
  3. Deploy with astro deploy.

​
Next steps

Plan an upgrade to a Runtime version that includes the fix, such as Astro Runtime 3.3-10. Once you upgrade, you can revert your Dockerfile to the standard image and remove the extra steps.