Security Advisory: eMudhra Intermediate CA Compromise

We have completed updating the Obsidian connectors and data retrieval has now been resumed. Please reach out to Obsidian support if you have any questions or observe any issues.

Security Advisory: eMudhra Intermediate CA Compromise
Published: Oct 20, 2026 | Last updated: Oct 21, 2026

Summary
On October 20, 2026, a security issue affecting several intermediate certificate authorities (CAs) operated by eMudhra was publicly disclosed (https://emudhra.we-have-a-problem.com/). The flaw could allow a third party to issue fraudulent TLS certificates for arbitrary domains. This is an industry-wide issue affecting any system that trusts the affected CAs. It is not the result of a compromise of Obsidian Security systems.

Our response
Obsidian Security began investigating promptly following disclosure. Exploiting this issue requires an attacker to intercept network traffic in addition to holding a fraudulent certificate. Based on our investigation to date, we have found no evidence that this issue was exploited against Obsidian Security systems or customer data.

- We are taking all precautionary measures to prevent this issue from being exploited in our environments:
- We retired all at-risk certificates from all corporate endpoints
- We have gated our software build pipelines so that only systems with updated trust stores can build and release code
- We have updated all Obsidian connectors to remove trust for the affected CAs.
- We are removing trust in the affected certificate authorities across our production platform, data collection services, and build infrastructure
- Tracking the response of our critical third-party providers

Customer Impact

UPDATE Oct 21, 2026 - All Connectors have been updated and data retrieval has resumed.

Obsidian Connectors to third party enterprise applications will be paused for up to four (4) hours from 23:45 GMT on Oct 20th, 2026. We will re-enable each connector as it is addressed. Data streaming from paused connectors should resume without data loss. This post will be updated when all data connectors have been addressed and restarted.

Questions
Please contact Obsidian Support at support@obsidiansecurity.com or via the Obsidian Admin portal. We will update this advisory if our assessment changes.