eMudhra certificate compromise: Appwrite is patched_

In October 2026, the private keys of eight eMudhra intermediate certificates were compromised. Browsers and operating systems trusted those intermediates, so anyone holding the keys can issue a certificate for any domain, and clients that still trust the chains accept it as valid.

Appwrite is patched:

• Appwrite Cloud runs patched images in every region. No action is needed.
• Self-hosted Appwrite rejects the compromised chains from Appwrite 2.6.0 and 1.9.8. Upgrade to 2.6.1 or 1.9.9, which include the patch.
• Appwrite's own certificates are not issued by eMudhra, so no Appwrite endpoint or domain needs a new certificate.

TLS verification stays enabled everywhere. We patched this by changing which certificates Appwrite trusts, not by relaxing any checks.

What the eMudhra compromise means for TLS clients

When a client connects over HTTPS, it checks that the server's certificate chains to a trusted root and matches the hostname. A certificate forged with a compromised intermediate key passes both checks, because the intermediate itself is trusted. An attacker who can intercept traffic between a client and a server could then impersonate that server.

Verifying certificates more strictly doesn't help. The only fix is to stop trusting the compromised chains, which means updating the trust store that each client uses. This is not a weakness in TLS encryption itself.

How Appwrite now rejects the compromised chains

Appwrite's servers and workers make outbound HTTPS requests on your behalf. They deliver webhooks, exchange tokens with OAuth2 providers, and call messaging providers, among other things. Those requests use the CA trust store of the Appwrite container. Before this update, that trust store accepted the eMudhra chains, as it did in most Linux images.

The patch updates that trust store in Appwrite's images:

• Appwrite 2.6.0 requires Alpine's ca-certificates package at 20261020-r0 or later, which distrusts the compromised chains, and builds the embedded Go Git helper with Go 1.27.3, which adds an eMudhra denylist to crypto/x509.
• Appwrite 1.9.8 applies the same ca-certificates update.
• Both releases also update the image stage that downloads dependencies, so the build itself rejects the chains.

We tested Appwrite's cURL and Swoole HTTP clients against the public test hosts that Mozilla's Dennis Jackson maintains at emudhra.we-have-a-problem.com. Both clients reject the compromised chains and still accept normal HTTPS endpoints. Appwrite Cloud runs the same patched base image.

Upgrading self-hosted Appwrite

Self-hosted 2.x installations should upgrade to Appwrite 2.6.1, and 1.9 installations to Appwrite 1.9.9. Both include the eMudhra patch. From 2.6.0 or 1.9.8, the upgrade only replaces the images.

Back up your instance, then run the upgrade and the migration for your version from the parent directory of your installation:

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:2.6.1
cd appwrite/
docker compose exec appwrite migrate

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:1.9.9
cd appwrite/
docker compose exec appwrite migrate

To confirm that your instance rejects the compromised chains, run this from the appwrite directory. It requests a normal HTTPS endpoint and one of the compromised test hosts from inside the Appwrite container:

docker compose exec appwrite php -r '
foreach (["example.com", "dv-g3b-emudhra.we-have-a-problem.com"] as $host) {
    echo $host, ": ", @file_get_contents("https://$host/") === false ? "rejected" : "accepted", PHP_EOL;
}'

A patched instance prints accepted for example.com and rejected for the test host. If the test host prints accepted, the container is still running an older image.

Replacing eMudhra certificates on your own endpoints

Once patched, Appwrite refuses to connect to any endpoint that presents a compromised eMudhra chain. That includes webhook receivers, SMTP servers, and S3-compatible storage endpoints. If one of your integrations starts failing with a certificate error after the upgrade, replace that endpoint's certificate.

Don't turn off Certificate verification (SSL/TLS) on a webhook to work around the error. That removes the protection against exactly the forged certificates this incident makes possible.

Your own servers and apps need the same trust store update. Server code that calls Appwrite through an SDK uses the trust store of its operating system or runtime, so update its CA package. The test site lists the patched ca-certificates versions for Alpine and Debian, and the patched Go releases.

Following the eMudhra remediation

We are watching the incident for further updates, and we will patch Appwrite Cloud and self-hosted Appwrite again if anything changes. To report a security issue in Appwrite, email security@appwrite.io or follow the Appwrite security policy.