GO-2026-6809 (CVE-2026-111943): Go, crypto/x509 and the eMudhra certificates

GO-2026-6809 (CVE-2026-111943) is a fix in crypto/x509, the Go package that verifies TLS certificates. The Go team added a denylist of eMudhra intermediate certificates to it. Their private keys leaked, so anyone who has them can forge a certificate for any website. According to the Go vulnerability database (2026), Go 1.27.3 and 1.26.10 contain the fix.

There is a catch that is easy to miss. A Go program carries the standard library inside its binary. A new Go version on the server does not change a program that is already running. Every program has to be built again and redeployed.

What GO-2026-6809 is and what happens without the fix

On 17 October 2026 a researcher told the browser and operating system root programs that the private keys of 8 eMudhra intermediate certificates could be guessed. According to Aikido's analysis, every one of these keys is smaller than 256, and one is the number 4. An intermediate certificate can sign a valid certificate for any domain. Whoever holds the key can pose as your bank, your payment provider, an API or a code repository.

A Go program that connects to another server over HTTPS checks its certificate with Certificate.Verify. On most platforms, Go uses the system's list of trusted certificates. The Go team writes that in some narrower cases that list will not update without further action. Then the program accepts a forged certificate as valid.

In practice, an attacker on the network path, for example on a Wi-Fi network or a compromised router, can put their own server in place of the real one. The Go program sends it whatever it would send the real server: API tokens, passwords, customer data, orders. It can also accept a forged response from it, such as a swapped update file. Much of today's infrastructure tooling is written in Go, including Kubernetes, Docker and Terraform, along with many in-house services and agents.

Source for the reporting deadline: GDPR, Regulation 2016/679, Article 33.

GO-2026-6809 in numbers: statistics 2026

Figures checked on 23 October 2026.

• According to the Go vulnerability database (2026), every Go version before 1.26.10 is affected, and so are versions from 1.27.0 before 1.27.3.
• According to the Go team (2026), versions 1.27.3 and 1.26.10 shipped on 19 October 2026, 2 days after the compromise was reported.
• According to Mozilla (2026), 8 eMudhra intermediate certificates are compromised: 6 for TLS and 2 for code signing.
• According to Aikido's analysis (2026), an attacker needed at most 256 guesses to find each of these keys.

Sources: GO-2026-6809 in the Go vulnerability database, Go team announcement, Mozilla on oss-security, Aikido.

Which Go versions are affected and which are fixed

The fix covers Certificate.Verify in crypto/x509. net/http, crypto/tls and almost every library that connects over HTTPS rely on that function. The Go team writes that in the new versions, Verify filters out chains that contain the blocked intermediates and does not return them to the caller.

How to patch GO-2026-6809: step by step

1. Find out which Go version built each program. go version -m reads it from the binary itself.
2. Raise the Go version in the project and in CI to 1.27.3 or 1.26.10.
3. Build every program again. That includes container images that compile the program in a build stage.
4. Update the ca-certificates package on the system and in images. Go reads the system certificate list, so it has to be current too.
5. Redeploy the programs and restart the services.
6. Check the result: govulncheck on the built binary and a connection test against the test address.

Useful commands:

go version                                # toolchain version
go version -m ./my-program                # which Go version built the binary
go get toolchain@go1.27.3                 # Go version in go.mod
govulncheck ./...                         # source code
govulncheck -mode=binary ./my-program     # built binary

In Docker, move the build image to a fixed version, for example golang:1.27.3, and build with --pull. scratch and distroless images often copy the certificate file from the build stage. Such an image keeps the list from the day it was built, so it needs a rebuild as well.

A test from inside the container or server where the program runs:

curl -sS -o /dev/null -w "HTTP %{http_code}\n" https://dv-g3b-emudhra.we-have-a-problem.com/

An SSL error with HTTP 000 means the system no longer trusts the compromised certificates. This test covers curl and the system list. To test the Go program itself, a small http.Get against the same address, built with the same Go version, works best: a patched program returns a certificate error.

What not to do

After the update you may see certificate errors in the logs. Do not switch verification off with InsecureSkipVerify: true. Cloudflare warns that this removes the very protection the update restores. The error usually means the server on the other side uses a chain that can no longer be trusted, or that the service carries its own outdated certificate list.

How Syntalith helps patch GO-2026-6809

In a company, Go programs live in many places at once: services, agents, CI tools, binaries copied to servers years ago. Swapping the toolchain in one repository does not close the problem. Our engineers do the whole job.

First we list the Go programs and images and check which version built each binary. Then we raise the Go version in projects and CI, rebuild programs and images, update ca-certificates and redeploy everything. Finally we test each service through its own TLS path, with verification switched on, and run govulncheck on the built binaries. You get a written report: what was vulnerable, what we rebuilt, and what needs your decision, such as a program without source code.

We work on your infrastructure, with access only for the duration of the job. We run the same steps on our own systems: on 23 October we moved our website, booking system and MCP server to Node.js 24.22.1, which carries the new certificate list.

Start with a free 30-minute call with an engineer. Tell us where your Go programs run, and we will tell you where to start and how long it will take. Book a call.

The full incident, with fixed versions for operating systems and other languages, is in our article on the compromised eMudhra certificates.