WARP users need updates after eMudhra certificate key compromise

Cloudflare’s October 20, 2026 disclosure of the eMudhra certificate key compromise comes with security updates for WARP, the 1.1.1.1 app and Cloudflare Tunnel. Which update you need depends on your app and operating system.

What the compromised keys could let an attacker do

According to Cloudflare, private keys associated with eight eMudhra intermediate certificates were compromised. The weak keys could let an attacker forge a certificate for any domain and impersonate a server to intercept or modify traffic.

The problem concerns certificate-based authentication—the check that a server is who it claims to be—not a break in TLS encryption algorithms. Cloudflare says its security review has not identified active exploitation on its services, but that does not establish whether exploitation has occurred elsewhere.

Cloudflare has deployed mitigations across its CDN, Developer and Zero Trust products, though further remediation is ongoing. It says Zero Trust customers using Gateway with an up-to-date client are automatically protected.

The app versions to install—and the iOS exception

Cloudflare One Client for Android should be updated to v2.5.6. The Cloudflare One iOS update was still awaiting app review at disclosure; that pending status does not refer to the separate 1.1.1.1 iOS app.

For the 1.1.1.1 app, the updates are v6.38.10 on Android and v6.31.7 on iOS. On Windows, macOS and Linux, the desktop update for Cloudflare One/WARP and 1.1.1.1 is 2026.8.2115.0.

Cloudflare Tunnel users should update cloudflared to 2026.10.2. Container deployments need both the fixed image and a redeployment.

A successful browser check does not cover every app

A browser and a background service can use different certificate verifiers or trust stores, so a successful browser check does not establish that the service is protected. The same limitation applies to a curl test when an application uses a different verifier.

Developers should check the HTTP library, language runtime, operating system and any custom trust configuration behind an SDK. Updating the SDK alone may leave certificate verification unchanged. Apply the relevant dependency updates, rebuild affected images, and reload, restart or redeploy applications as needed.

If an update produces certificate errors, do not fix them by disabling TLS or certificate verification. Keep official apps, operating systems and browsers up to date, and validate applications through the TLS verification path they actually use.