Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue

Final update

We have now released updated agent client patches for use in Remote Execution deployments that incorporate certificate trust updates to mitigate the vulnerability. These are 1.8.11, 1.7.7, and 1.6.5. See more details in the [Agent Release Notes](https://www.astronomer.io/docs/runtime/runtime-release-feed). Additionally, we have released another update of the Runtime images to handle the following two changes related to this vulnerability. • New virtual environments created with `python -m venv` now get pip 26.2.2 • Upgrade `grpcio` to 1.84.1, whose bundled CA list no longer includes the roots affected by the eMudhra compromise The following Runtime image versions include these changes. For more details see [Runtime Release Notes](https://www.astronomer.io/docs/runtime/runtime-release-feed). • **Runtime 13:** 13.12.2 • **Runtime 3.0:** 3.0-21 • **Runtime 3.1:** 3.1-24 • **Runtime 3.2:** 3.2-13 • **Runtime 3.3:** 3.3-11

1. Resolved · Oct 23, 21:28 UTC
   We have now released updated agent client patches for use in Remote Execution deployments that incorporate certificate trust updates to mitigate the vulnerability. These are 1.8.11, 1.7.7, and 1.6.5. See more details in the [Agent Release Notes](https://www.astronomer.io/docs/runtime/runtime-release-feed). Additionally, we have released another update of the Runtime images to handle the following two changes related to this vulnerability. • New virtual environments created with `python -m venv` now get pip 26.2.2 • Upgrade `grpcio` to 1.84.1, whose bundled CA list no longer includes the roots affected by the eMudhra compromise The following Runtime image versions include these changes. For more details see [Runtime Release Notes](https://www.astronomer.io/docs/runtime/runtime-release-feed). • **Runtime 13:** 13.12.2 • **Runtime 3.0:** 3.0-21 • **Runtime 3.1:** 3.1-24 • **Runtime 3.2:** 3.2-13 • **Runtime 3.3:** 3.3-11
2. Identified · Oct 22, 00:01 UTC
   Astronomer has released Runtime updates to address a publicly disclosed security vulnerability concerning private keys associated with eight eMudhra/emSign intermediate certificate authority (CA) certificates. For additional background, visit . **Scope and available updates** This advisory stems from an issue with a third-party certificate authority. Action required for customer-managed components depends on their specific certificate trust stores and verification mechanisms. The following Runtime releases incorporate certificate trust updates to mitigate this vulnerability: • **Runtime 13:** 13.12.1 • **Runtime 3.0:** 3.0-20 • **Runtime 3.1:** 3.1-23 • **Runtime 3.2:** 3.2-12 • **Runtime 3.3:** 3.3-10 For full details, please refer to the [Runtime release feed](https://www.astronomer.io/docs/runtime/runtime-release-feed). **Recommended customer actions** • Upgrade to the appropriate updated Runtime release for your environment. • Rebuild and redeploy custom images using the updated base image. Refer to our [mitigation guide](https://www.astronomer.io/docs/runtime/mitigate-emudhra-ca-compromise) for step-by-step instructions. • Audit customer-managed build pipelines and tooling, applying relevant vendor updates to certificate trust stores and signature verification components. • Ensure TLS and code-signature verification remain enabled. If updates cause validation failures, contact the endpoint owner or software publisher for replacement certificate or artifact guidance. Plea