Lesstep
GitHub Actions · Runners · Security · Checked November 5, 2026

GitHub Actions and the eMudhra CA compromise (CVE-2026-111943): which runners still trust it, and the fix for macOS runners

On October 17, 2026, the private keys of eight eMudhra intermediate CA certificates were shown to be compromised (the disclosure). Whoever holds one of those keys can issue a certificate for any host name. Browsers and the operating systems' own networking block them (Firefox and Chrome since October 17, Microsoft platforms since October 20, Apple products since October 22), but tools that check certificates against a CA bundle file, such as curl, git, Python, pip, Node.js and Java, keep trusting them until that file is updated. On a GitHub-hosted runner, those are the tools that fetch your dependencies and push your releases, so someone on the network path could pose as a package registry or a git remote.

Where each runner image stood on November 5, 2026

Checking from a workflow

The disclosure runs test hosts whose certificates come from the compromised intermediates. A certificate error means the client does not trust them:

- name: Check the eMudhra chains
  shell: bash
  run: |
    for h in dv-g3b-emudhra dv-g3b-aaa-emudhra; do
      if curl -sS -o /dev/null "https://$h.we-have-a-problem.com/"; then
        echo "$h: trusted"
      else
        echo "$h: rejected"
      fi
    done

"trusted" means that tool on that runner still accepts the compromised intermediates. Each tool can use a different bundle, so try the ones your jobs rely on the same way (git ls-remote, Python, Node.js). A network problem also looks like "rejected", so a "trusted" result is the one to act on.

On macOS, this step fails while /etc/ssl/cert.pem still has the affected roots (the check GitHub gives in #15228):

- if: runner.os == 'macOS'
  run: |
    openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout \
      | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' && exit 1 || echo "cert.pem is fixed"

On Ubuntu, dpkg-query -W ca-certificates prints the installed version.

Fixing it on macOS before the image does

Tools that bring their own roots

Fixing the system file does not reach tools that ship their own list. Versions with the fix, from the disclosure's list:

actions/setup-python itself downloads Python with the runner's Node 24, which rejects the chains on the fixed Ubuntu images (setup-python #1382).

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so a check step that starts failing stands out, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Apple and macOS are trademarks of Apple Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Apple Inc., eMudhra or JetBrains.

More: xcode-27 and the iOS 27.1 simulator · macOS 14 retired · GitHub Actions plugins for IntelliJ IDEA compared · 日本語