eMudhra/emSign CA compromise (October 2026): what Cloud SDK Java Libraries developers need to do #14915

Summary

Eight eMudhra (emSign) intermediate CA certificates have recoverable private keys (Mozilla bug 2083449). Clients whose trust store still contains emSign ECC Root CA - G3, emSign Root TLS CA - G3 or AAA Certificate Services can be impersonated by an on-path attacker.

The following packages and trust stores are affected

• com.google.api-client:google-api-client earlier than 2.9.2, when the HTTP transport is created with GoogleNetHttpTransport.newTrustedTransport(). Versions earlier than 2.9.0 always use a bundled trust store that includes AAA Certificate Services; versions 2.9.0 and 2.9.1 use it when the JDK trust store cannot be loaded.
• Google API service library packages (com.google.apis:google-api-services-*) with a version suffix earlier than -2.9.2, which depend on an affected google-api-client.
• The JDK trust store (cacerts), used by all other Google client transports, and the Windows certificate store on Windows.

You can take the following actions to resolve these issues

• Upgrade google-api-client to 2.9.2 or later, or com.google.cloud:libraries-bom to 26.91.0 or later.
• If your build declares a service library without google-api-client, upgrade the service library to a release whose version ends in -2.9.2 or later (for example google-api-services-bigquery:v2-rev20260922-2.9.2), or declare com.google.api-client:google-api-client:2.9.2 directly.
• If you use Spring Framework on Google Cloud, upgrade to the current patch release of your line: 8.3.1, 7.5.2, 6.5.12, 3.9.19 or later; these import libraries-bom 26.91.0.
• Apply your JDK vendor's security update.
• On Windows, apply the Windows root certificate update.

Advisory: GHSA-m4gc-hcgx-wmc7 (google-api-client).

Google Cloud Security Bulletin: GCP-2026-075.

This issue is locked. Please open a new issue for questions.