28 lines
2.3 KiB
Markdown
28 lines
2.3 KiB
Markdown
# cloudflared 2026.10.3 — the eMudhra notice (R-1300), 2026-10-26 evening
|
|
|
|
**The notice.** Cloudflare, 2026-10-20 (blog „8 eMudhra certificates are compromised"): eight eMudhra (emSign)
|
|
intermediate CA keys were weak (recoverable from the public certificates; six TLS, two code-signing). cloudflared
|
|
before 2026.10.2 trusts them. Docker users take the fixed image. Cloudflare: „do not resolve these errors by disabling
|
|
verification". Release notes: 2026.10.2 = Go 1.27.3 + new distroless base (the trust store); 2026.10.3 = newer
|
|
debian base + Go bump. 2026.10.4 (2026-10-26, today) adds a metrics-endpoint allowlist (VULN-176088) — not taken:
|
|
under a day old, and the notice names 2026.10.3.
|
|
|
|
**Image.** `cloudflare/cloudflared:2026.10.3` index digest
|
|
`sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39` (Docker Hub API and a pull on 9202 agree;
|
|
amd64 `sha256:c3f24df7…`); `--version` = `cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)`.
|
|
(`part3-image-check.txt`)
|
|
|
|
**Part 1 — the list.** Three boxes report to the hub (demo-felhom, demo-hp, Tester 1); each guest 9201 runs
|
|
`cloudflare/cloudflared:2026.9.3` (`part1-boxes.txt`, `part1-hub-hosts.txt`). 9202 (scratch) has no tunnel. Tester 2: no box.
|
|
DooPlex: no cloudflared in k3s, Docker, systemd, dpkg or processes; the same queries find traefik/the hub (control)
|
|
(`part1-dooplex.txt`). Cloudflare account: CC holds no Cloudflare token (`sec list`); the connector versions are the
|
|
operator's look in Networking → Tunnels.
|
|
|
|
**Part 2 — the https-origin trap.** Every tunnel's remote route (cloudflared's own „Updated to new configuration" log
|
|
line, all three boxes): `*.<domain>` → `https://traefik`, `originRequest.noTLSVerify: true`, then `http_status:404`
|
|
(`part2-remote-config.txt`). traefik answers SNI `traefik` with `CN=TRAEFIK DEFAULT CERT`, self-signed
|
|
(`part2-origin-cert.txt`). No eMudhra chain → the new trust store refuses nothing on the origin leg: **the trap does
|
|
not apply.** The `noTLSVerify` is the day-0 recipe (R-510) for a leg that never leaves the guest (cloudflared and
|
|
traefik alone on the /29 `felhom-tunnel`); not changed tonight (the brief forbids touching certificate checks, and
|
|
turning verification ON needs traefik to present a cert cloudflared can verify — a design question, not tonight).
|