Skip to main content

Changelog

Updates, changes, and improvements at Retool.

Refer to the stable and edge release notes for detailed information about self-hosted releases.

Compromised eMudhra/emSign intermediate CAs trusted by bundled certificate stores

Summary​

  • Several of eMudhra's emSign intermediate certificate authorities were compromised and revoked upstream. Components bundled in Retool trusted certificates signed by those intermediates.
  • This created a man-in-the-middle risk for self-hosted instances on affected versions: an attacker would need both a certificate from the compromised intermediates and a network position between your instance and an external endpoint.
  • Cloud was patched centrally. Self-hosted customers should upgrade.
  • IOCs: None. No exploitation observed, and no indication any maliciously signed package was pulled in.
  • Maintained stable releases contain a full fix (v4.0 and newer), version 3.334 received a partial fix for the Node, Python, and PIP systems, Java was not patched due to no upstream patch available.

What happened​

eMudhra's emSign intermediate CAs were compromised and revoked, and upstream projects (OS ca-certificates, Node.js, Java, and Python certifi/pip) distrusted them. Retool components ship their own bundled CA lists, so older Retool versions continued to trust the compromised chain even on a patched host OS.

Affected components​

The upstream issue is the compromised emSign intermediate CAs (emSign ECC Root CA - G3 and the Comodo AAA Services cross-sign root). Retool components that validated certificates against a bundled CA list were affected:

  • Node.js.
  • The database connector's Java runtime.
  • The OS CA bundle.
  • The code executor's Python (requests/pip), custom Python environments, and drivers such as @sap/hana-client and oracledb (thick mode).
  • The telemetry sidecar and the fluent-bit image.

Affected versions​

DeploymentAffected
CloudAffected before 2026-10-21; patched centrally
Self-hosted stable 4.0 line4.0.x up to and including 4.0.23
Self-hosted stable 4.34 line4.34.x up to and including 4.34.10
Self-hosted edge4.78.0 and earlier
Self-hosted legacy3.334.x

Note: 4.0.23 and 4.34.10 do not contain the fix. Do not treat them as patched.

Fixed versions​

DeploymentFixed versionPublished
CloudPatched in production2026-10-21
Self-hosted 4.0 line4.0.252026-10-23
Self-hosted 4.34 line4.34.122026-10-23
Self-hosted edge4.81.02026-10-23
Self-hosted legacy 3.334Partial patch (Node fixed; Java and host-level items not)2026-10-24

Am I affected?​

If you run a self-hosted instance on an affected version, it continues to trust the compromised chain. Exploitation would require an attacker to hold a certificate from the compromised intermediates and to sit in the network path between your instance and an external endpoint. There is no indication of actual exploitation. Customer-provided CA certificates attached to a resource apply only to that resource's connections and are never added to a shared or system trust store.

What you should do​

  • Cloud: No action. Patched centrally on 2026-10-21.
  • Self-hosted 4.0 line: Upgrade to 4.0.25.
  • Self-hosted 4.34 line: Upgrade to 4.34.12.
  • Self-hosted edge: Upgrade to 4.81.0.
  • Self-hosted legacy 3.334: Upgrade to the 3.334 patch or move to v4. The 3.334 patch is partial — it fixes Node but not Java or host-level items.

Do not rely on 4.0.23 or 4.34.10; they do not contain the fix.

CVE details​

FieldValue
CVECVE-2026-91403, CVE-2026-111943
Upstream componenteMudhra emSign intermediate CAs (via ca-certificates, Node.js, Java, Python certifi/pip)

Revision history​

  • 2026-10-26 — Initial publication.