JetBrains Responds to eMudhra Certificate Authority Security Incident
Critical security updates released following the discovery of eMudhra intermediate certificate authority vulnerabilities.
1Incident Overview and Discovery
On October 17, 2026, researchers identified that private keys for eight eMudhra intermediate certificate authorities were recoverable due to generation flaws. This vulnerability allows attackers to forge trusted certificates. While operating system vendors have blocked these chains, applications utilizing bundled trust stores require manual intervention to maintain secure communication and integrity.
2Impact on JetBrains Portfolio
The security incident affects a wide range of JetBrains tools, including IDEs, Toolbox App, TeamCity, YouTrack, and Hub. Because these products rely on Java runtimes, specifically JetBrains Runtime, they inherited trust in the compromised certificates. No active exploitation against customers has been reported, but remediation remains a high priority.
3Java Runtime Remediation Strategy
JetBrains Runtime versions 21 and 25 have received critical updates to address the trust store issues. Since IDEs bundle their own runtime, updating the software is sufficient for most users. However, for standalone Java environments or self-hosted build agents, administrators must manually update the runtime to ensure the compromised certificates are removed.
4Product-Specific Update Status
Many core products like IntelliJ-based IDEs, Rider, and YouTrack have already received fixed versions. Other tools, including Qodana and Kotlin CLI, are currently undergoing partial or full remediation. Users should verify their specific version against the official JetBrains security advisory table to determine if an immediate update or workaround is required.
5TeamCity and Cloud Considerations
TeamCity users must update Java runtimes on every server node and self-hosted build agent. For Docker deployments, administrators should pull updated images or patch existing ones manually. Conversely, JetBrains cloud services like Datalore and YouTrack Cloud are being managed internally, requiring no direct action from customers except for self-hosted agent maintenance.
6Manual Mitigation and Workarounds
If immediate software updates are impossible, users should manually remove the emSign ECC Root CA G3 and AAA Certificate Services from the Java trust store. Disabling certificate validation is strictly discouraged as it weakens security posture. Always ensure the underlying operating system's ca-certificates package is updated to reflect the latest vendor-provided security patches.
7Kotlin and Toolchain Guidance
Kotlin users face specific challenges regarding the Gradle plugin and Node.js dependencies. Developers are advised to explicitly set Node.js to version 24.22.1 or later in build scripts. Disabling the Node.js toolchain service via gradle.properties may be necessary until official patches for the Kotlin Gradle plugin are released to resolve the certificate trust issues.
8Future Security Outlook
JetBrains continues to monitor certificate trust across its entire infrastructure and product suite. Ongoing remediation efforts will be documented in product release notes and security advisories as fixes are finalized. Customers are encouraged to maintain a proactive stance by keeping all development environments, runtimes, and software versions updated to mitigate potential risks.