Salt 3006.29, 3007.16 and 3008.4 Patch eMudhra Certificate Authority Flaw
Salt released versions 3006.29 (LTS), 3007.16 (STS) and 3008.4 (LTS) to remove the compromised emSign root after Mozilla disclosed that eMudhra generated private keys incorrectly for eight intermediate CAs, so administrators who make HTTPS requests or use the bundled pip should upgrade.
Salt versions 3006.29 (LTS), 3007.16 (STS), and 3008.4 (LTS) are out to address the eMudhra/emSign certificate authority incident. You need to upgrade if your setup makes HTTPS requests or uses the bundled pip.
On October 20, Mozilla disclosed that eMudhra incorrectly generated private keys for eight intermediate certificate authorities. Anyone can recover these keys directly from the certificates. Six issue TLS certificates and two issue code-signing certificates. Vulnerable TLS clients accept certificates built with recovered keys for any domain, exposing connections to man-in-the-middle attacks.
Mozilla removed the affected emSign ECC Root CA - G3 root from its trust store. Google plans to remove it from the Chrome Root Store by October 27. The Python certifi bundle dropped the root in version 2026.10.19, and maintainers urge updating pip plus rebuilding container images.
Browsers get automated fixes, but software carrying its own trusted certificate lists requires manual patches. Salt falls into this category because it makes HTTPS requests and ships its own pip.
Administrators on Salt 3006, 3007, or 3008 must update to 3006.29, 3007.16, or 3008.4. eMudhra revoked the compromised certificates, halted issuance under the G3 root, and estimates 30,000 customer certificates require migration to new chains.