GHSA-6q48-6c7w-9gw2
certifi bundles emSign root CAs with compromised intermediate CA keys
GHSA-6q48-6c7w-9gw2 is a critical vulnerability (CVSS 9.1) in certifi, published October 20, 2026. No source lists public exploit code. Fixed in certifi 2026.10.18.
- Severity
- 9.1 CriticalCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2026.10.18certifi +2 more
Description
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.
Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
certifiPyPI | 2019.03.09 up to 2026.10.18 | 2026.10.18 |
certifiPyPI | 2019.03.09 up to 2026.10.18, plus listed versions 2019.11.282019.3.92019.6.162019.9.112020.11.8 Show 37 moreShow less2020.12.52020.4.52020.4.5.12020.4.5.22020.6.202021.10.82021.5.302022.12.72022.5.182022.5.18.12022.6.152022.6.15.12022.6.15.22022.9.142022.9.242023.11.172023.5.72023.7.222024.12.142024.2.22024.6.22024.7.42024.8.302025.1.312025.10.52025.11.122025.4.262025.6.152025.7.142025.7.92025.8.32026.1.42026.2.252026.4.222026.5.202026.6.172026.7.22 | 2026.10.18 |
certifiRoot:PyPI | before 2019.11.28+aikido.2 | 2019.11.28+aikido.22026.5.20+aikido.12026.10.18+aikido.12026.7.22+aikido.12024.7.4+aikido.12026.6.17+aikido.12026.4.22+aikido.12025.4.26+aikido.12026.2.25+aikido.12026.1.4+aikido.1 |
What each source reports
GitHub Advisories Score used
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.
Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
- Record
GHSA-6q48-6c7w-9gw2- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.
Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
- Record
GHSA-6q48-6c7w-9gw2- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVPYSEC-2026-4320
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.
An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and pip, and the Python.org macOS installer.
Certifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.
- Record
PYSEC-2026-4320- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVROOT-APP-PYPI-GHSA-6q48-6c7w-9gw2No score
GHSA-6q48-6c7w-9gw2 in certifi - Patched by Root
Root has patched GHSA-6q48-6c7w-9gw2 in the certifi package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-GHSA-6q48-6c7w-9gw2- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
emudhra.we-have-a-problem.com
pypi.org/project/certifi