Addressing eMudhra Certificate Authority Compromise in TeamCity Environments
Critical security guidance for updating Java runtimes and managing compromised eMudhra certificates.
1Compromise of eMudhra Keys
In October 2026, eight intermediate certificate authorities operated by eMudhra were identified with weak private keys. While eMudhra reports no evidence of exploitation or leaf certificate issuance, the vulnerability necessitates immediate action. These keys were recoverable from public data, posing a significant risk to software components relying on these specific trust chains.
2TeamCity Trust Store Impact
The issue is not a vulnerability within TeamCity itself, but rather a trust store dependency. Java runtimes used by TeamCity server nodes and build agents often maintain these compromised certificates. Consequently, software relying on these runtimes may continue to trust invalid certificates unless the underlying trust stores are manually updated or patched.
3Automated Health Reporting Tools
JetBrains introduced health reports in TeamCity versions 2026.2.2 and 2026.1.6 to detect affected certificates. These reports provide administrators with visibility into their installation status and offer remediation pathways. Upgrading to these versions is the primary recommended step for on-premises users to ensure their build environments remain secure against potential certificate-based attacks.
4Java Runtime Update Requirements
Administrators must update the Java runtime on every server node and build agent. Specifically, users should target CVE-2026-91403 and CVE-2026-114820. For Amazon Corretto 21, the required build is 21.0.13.0.11 or later. After updating, restarting each node is mandatory to ensure the new trust store configurations are correctly loaded and active.
5Managing TeamCity Cloud Instances
TeamCity Cloud has been updated by JetBrains to mitigate the core issue. However, users must still review any custom certificates uploaded to the service. Self-hosted build agents connected to TeamCity Cloud remain the responsibility of the customer and require independent Java runtime updates and certificate store audits to ensure full compliance.
6Redeploying Docker-Based Installations
For containerized environments, simply updating the Java runtime is insufficient. Administrators must pull the patched 2026.2.2 or 2026.1.6 server and agent images from Docker Hub. Alternatively, existing images should be rebuilt using updated base configurations. After pulling or rebuilding, all containers must be recreated to apply the security fixes effectively across the infrastructure.
7Reviewing Uploaded Custom Certificates
Updating Java does not automatically remove certificates previously uploaded to TeamCity. Administrators must manually inspect custom certificates located in the server's data directory or agent configuration folders. Using the provided inspection commands, teams can identify and delete affected files to prevent the continued use of compromised eMudhra-issued certificates within their build pipelines.
8Updating Supporting Build Infrastructure
The compromise extends beyond TeamCity. Build tools, operating systems, Python’s certifi, Node.js, and Git must be reviewed independently. Each component maintains its own trust store that may still contain the weak eMudhra certificates. Custom images must be rebuilt to incorporate these vendor-specific updates, ensuring that the entire CI/CD pipeline remains secure.
9TeamCity CLI Security Updates
The TeamCity CLI is distributed separately and requires a manual update to version 1.6.1, released on October 26, 2026. This version was rebuilt with Go 1.27.3 to include the necessary security fixes. Users must run the update command on every machine where the CLI is utilized, including all active build agents.
10Manual Mitigation for Legacy Systems
If upgrading the Java runtime is not immediately feasible, manual mitigation is available. This involves copying the blocked.certs file from a patched JDK to the current runtime location. Administrators must back up the trust store before proceeding, as removing root certificates can disrupt connections to other services that rely on them.
11Technical Verification Command Usage
Verification scripts for Linux, macOS, and Windows are provided to identify compromised certificates by fingerprint. These scripts utilize the keytool utility to scan trust stores and custom certificate directories. The output clearly indicates whether action is required, allowing administrators to confirm the security status of their specific Java runtime and configuration.
12Proactive Security Maintenance Strategy
This incident highlights the necessity of maintaining updated trust stores across all development infrastructure. Because certificate authority compromises can affect any software relying on standard trust chains, regular audits of build agents and server configurations are essential. Consistent monitoring and rapid patching remain the most effective defenses against widespread certificate-based security threats.