- Sourcegraph container images no longer trust certificates issued through the compromised eMudhra intermediate CAs (CVE-2026-111943).
- The private keys of eight eMudhra intermediate CA certificates were generated incorrectly and can be recovered from the certificates themselves. Sourcegraph services and executors could have trusted TLS certificates issued through these intermediates on outbound connections, such as connections to code hosts.
- Sourcegraph Cloud instances already include the fix, but Cloud customers using Sourcegraph Connect must also upgrade the agent deployed in their own network. Self-hosted customers should upgrade Sourcegraph and their executors to 8.1.1335 or later.
Sourcegraph Amp / Cody lineage: Distrusting compromised eMudhra certificate authorities
First seen · Sourcegraph
Security fix