2.3 KiB
cloudflared 2026.10.3 — the eMudhra notice (R-1300), 2026-10-26 evening
The notice. Cloudflare, 2026-10-20 (blog „8 eMudhra certificates are compromised"): eight eMudhra (emSign) intermediate CA keys were weak (recoverable from the public certificates; six TLS, two code-signing). cloudflared before 2026.10.2 trusts them. Docker users take the fixed image. Cloudflare: „do not resolve these errors by disabling verification". Release notes: 2026.10.2 = Go 1.27.3 + new distroless base (the trust store); 2026.10.3 = newer debian base + Go bump. 2026.10.4 (2026-10-26, today) adds a metrics-endpoint allowlist (VULN-176088) — not taken: under a day old, and the notice names 2026.10.3.
Image. cloudflare/cloudflared:2026.10.3 index digest
sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39 (Docker Hub API and a pull on 9202 agree;
amd64 sha256:c3f24df7…); --version = cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC).
(part3-image-check.txt)
Part 1 — the list. Three boxes report to the hub (demo-felhom, demo-hp, Tester 1); each guest 9201 runs
cloudflare/cloudflared:2026.9.3 (part1-boxes.txt, part1-hub-hosts.txt). 9202 (scratch) has no tunnel. Tester 2: no box.
DooPlex: no cloudflared in k3s, Docker, systemd, dpkg or processes; the same queries find traefik/the hub (control)
(part1-dooplex.txt). Cloudflare account: CC holds no Cloudflare token (sec list); the connector versions are the
operator's look in Networking → Tunnels.
Part 2 — the https-origin trap. Every tunnel's remote route (cloudflared's own „Updated to new configuration" log
line, all three boxes): *.<domain> → https://traefik, originRequest.noTLSVerify: true, then http_status:404
(part2-remote-config.txt). traefik answers SNI traefik with CN=TRAEFIK DEFAULT CERT, self-signed
(part2-origin-cert.txt). No eMudhra chain → the new trust store refuses nothing on the origin leg: the trap does
not apply. The noTLSVerify is the day-0 recipe (R-510) for a leg that never leaves the guest (cloudflared and
traefik alone on the /29 felhom-tunnel); not changed tonight (the brief forbids touching certificate checks, and
turning verification ON needs traefik to present a cert cloudflared can verify — a design question, not tonight).