# Apple macOS Git Vulnerability Due to Compromised eMudhra Certificates Developer tools on macOS remain vulnerable to interception despite reported certificate security flaws. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/2d2f0465-0a23-464a-884b-6c682b298830 ## Persistent Certificate Trust Issues Apple was notified of the eMudhra certificate incident on October 17, yet as of October 28, native macOS developer tools remain vulnerable. Git, curl, and python3 continue to trust the compromised certificates. This oversight leaves critical development workflows exposed to potential HTTPS interception, despite other community projects having already implemented necessary security patches. ## Regression in macOS Updates The release of macOS 27.2 on October 26 failed to address the vulnerability. Furthermore, the update actively reverted manual workarounds previously applied by developers to mitigate the risk. This regression forces users back into a vulnerable state, highlighting a significant gap in Apple's current patch management for developer-facing system components. ## Git Repository Integrity Risks The vulnerability allows attackers to intercept HTTPS connections, enabling the injection of malicious code during git clones or pulls. Pushes can be altered in transit, and sensitive credentials like GitHub tokens are susceptible to theft. Attackers on the network path can effectively impersonate remote servers, compromising the entire software supply chain. ## Verification of System Exposure Developers can verify their exposure by running specific commands against test servers. Using 'git ls-remote' against the provided eMudhra test domain reveals if the system is protected. If the command returns a commit list instead of a certificate error, the environment is confirmed as vulnerable to traffic interception and tampering. ## Demonstrating the Attack Vector An end-to-end attack can be simulated using the 'git -c http.curloptResolve' command to redirect traffic to a test server. This setup presents a fake certificate issued by the compromised intermediates. A patched system will reject the connection, while a vulnerable system will successfully clone the repository, confirming the security failure. ## Scope of Affected Tooling The issue is not limited to Git; curl and python3 are similarly affected by the trust store configuration. While Apple has successfully secured Safari and applications utilizing its primary networking framework, the command-line tools remain unpatched. This discrepancy creates a false sense of security for developers relying on standard terminal-based workflows. ## Manual Remediation and Maintenance Developers can manually remove the affected roots from '/etc/ssl/cert.pem' to secure their environments. However, because macOS updates may revert these changes, users must perform repeated checks after every system update. This manual maintenance cycle is necessary until Apple provides an official, persistent fix for the underlying certificate trust issue. ## Supply Chain Security Implications Security teams must evaluate the risk posed to CI/CD pipelines and build infrastructure utilizing macOS runners. Given the potential for code injection and credential theft, organizations should audit their build environments immediately. The persistence of this vulnerability necessitates proactive monitoring of developer workstations until an official patch is deployed by Apple. ## Sources covering this story - https://emudhra.we-have-a-problem.com/apple.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._