[Security] Java eMudhra certificate vulnerability (CVE-2026-91403): Snowplow-managed pipelines patched

[24-Oct-2026]

A critical vulnerability in Java's TLS certificate handling (JSSE), CVE-2026-91403, was disclosed this week (Oracle Security Alert). It follows the compromise of several eMudhra intermediate certificate authorities: Java runtimes that still trust them could accept a forged certificate as genuine.

We have had questions from several customers, so this notice sets out our position and the action we have taken.

Is Snowplow affected?

Some components were, and they have now been patched. Several Snowplow pipeline components run on Java and shipped certificate trust data that still accepted the affected eMudhra certificates.

The practical risk is low. Exploiting this requires an attacker to intercept traffic between our infrastructure and the cloud services it connects to, and to present a forged certificate. Incoming traffic to the Collector from your trackers is not affected.

What have we done?

We have released updated versions of our Java-based components, built on a base image that no longer trusts the affected certificate authorities, and rolled them out across Snowplow-managed pipelines:

RDB Loader 6.9.0 and later already include the fixed base image.

Related: Python certifi advisory (GHSA-6q48-6c7w-9gw2)

The same eMudhra compromise was also published as an advisory for certifi, the certificate bundle used by Python. On Snowplow-managed pipelines, it was flagged on a supporting AWS Lambda function for the Collector. We updated it to aws-instance-rotate 0.3.3, which includes certifi 2026.10.19, and rolled it out to all AWS pipelines on 22 October 2026.

Do I need to do anything?

If Snowplow manages your pipeline: no. The updates have been applied by Snowplow, with no action needed on your side.

If you run Snowplow components in your own infrastructure: upgrade each component listed above to the fixed version or later, published on Docker Hub and in each component's GitHub repository. Earlier versions should be treated as affected, apart from RDB Loader 6.9.0 and later.

A note for security scanners

Our fix works by removing the affected root certificate authorities from the list Java trusts. Oracle's own fix works differently, by adding the compromised intermediate certificates to Java's blocklist, and our Java vendor has not published that blocklist update yet.

Some scanners check for the blocklist update, or for a specific Java version, so they may still report CVE-2026-91403 on our updated images. The vulnerable path is closed, and we will include the blocklist update in a routine release once it is available.

Questions

If you have any questions, your scanner reports a finding on an updated image, please raise a ticket with Snowplow Support and reference this notice.