eMudhra/emSign CA compromise (October 2026): what Cloud SDK Python Libraries developers need to do #2852

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages are affected

• certifi earlier than 2026.10.19 (REST transports).
• httplib2 earlier than 0.32.1, used by google-api-python-client and google-auth-httplib2; its bundled trust store is used when certifi is not installed.
• grpcio earlier than 1.84.1 (gRPC transports); bundled root store, does not read the operating system trust store.

You can take the following actions to resolve these issues

• Upgrade certifi to 2026.10.19 or later.
• Upgrade httplib2 to 0.32.1 or later.
• Upgrade grpcio to 1.84.1 or later. Patch releases for earlier release lines are being published; see GHSA-2xm2-c8xx-p9vh for the current list of fixed versions.

Advisories:

• GHSA-6q48-6c7w-9gw2 (certifi)
• GHSA-2xm2-c8xx-p9vh (grpcio)

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.