NEW Solace Fall ’26 Edition: Unbound is now live See the release

Last Updated: October 27, 2026 at 5:00PM (EST)
Status: Under Investigation

Solace is aware of the recently reported root certificates that are no longer trusted (emSign ECC Root CA – G3, emSign Root CA – C1, and emSign ECC Root CA – C3) and is performing a full analysis of our exposure: eMudhra: Private key compromise of Intermediate Certificates. This page will be updated as new information becomes available.

Initial Analysis

Solace Event Broker

  • The Event Broker’s standard domain certificate authority list, which is enabled by default, includes emSign root certificates that are no longer trusted. A broker that makes outbound TLS connections, for example to REST consumers or OAuth providers, would accept a server certificate chaining to one of these roots.
  • All Solace Event Broker versions contain the affected emSign root certificates in the list of default trusted certificate authorities.
  • Solace strongly recommends upgrading all brokers to resolve this issue.  Solace resolved this vulnerability in broker releases 10.26.9.13589, 10.26.0.9163, 10.25.0.402, and 10.8.1.604, on October 27, 2026.
  • As a work-around, if brokers cannot be upgraded, Solace will soon provide instructions to disable the affected certificates.  This procedure will be a temporary work-around which must be removed after upgrading the brokers.

Solace Cloud

  • Numerous Solace Cloud console components contain the affected emSign root certificates, however many do not initiate outgoing connections so are not exposed to this vulnerability.
  • Solace has begun patching all affected services on a priority basis.

Solace Agent Mesh

  • All Solace Agent Mesh versions contain the affected emSign root certificates in the list of trusted certificate authorities.
  • Most Solace Agent Mesh outbound connections, including LLM connections, include the affected emSign root certificates.  This was resolved in Solace Agent Mesh v2.455.0 and is available now.
  • The Solace Agent Mesh Broker client library and Mac desktop app are also affected.  These will be resolved in an upcoming release planned for October 28, 2026.
  • Solace strongly recommends upgrading all Solace Agent Mesh to resolve this issue.

Solace Micro-Integrations

  • The docker image of all versions of all Solace Micro-Integrations contain an OpenJDK JRE which contains the affected emSign root certificates in the list of trusted certificate authorities.
  • A work-around is available from OpenJDK.  Refer to https://openjdk.org/emudhra for details.
  • Solace strongly recommends upgrading all micro-integrations to resolve this issue, when the fix has been released. Solace will resolve this exposure in all Micro-Integrations.  We are awaiting upstream fixes, so no ETA is available yet.

Solace Schema Registry

  • Solace Schema Registry versions 1.0.0 through 1.1.2 are impacted. Solace will release version 1.1.3 to resolve this vulnerability.
  • This release is targeted for November 5, 2026.

Nisshi Diskless Streaming for Apache Kafka®

  • Versions 0.7.0 and earlier contain the affected emSign root certificates in the list of trusted certificate authorities.
  • Version 0.8.1 was released on October 27, 2026 to address this vulnerability.  Solace strongly recommends upgrading to resolve this issue.

 

Solace Messaging APIs

  • No Solace Messaging APIs are exposed to this issue.