# Security Notice Regarding Compromised eMudhra Intermediate CA

> Compromised eMudhra CA keys could allow an attacker intercepting outbound TLS connections to impersonate JWKS endpoints or databases, potentially bypassing authentication or exposing data.

- Published: 2026-10-21
- Category: Announcement
- Source: https://powersync.com/blog/emudhra-security-notice

---

## Summary
Compromised eMudhra CA keys could allow an attacker intercepting outbound TLS connections to impersonate JWKS endpoints or databases, potentially bypassing authentication or exposing data.

## Details
PowerSync Service Docker images before v1.27.1 include CA trust bundles that can trust certificates issued using compromised eMudhra intermediate CA keys.

An attacker with the ability to intercept or redirect outbound TLS connections could impersonate services that PowerSync connects to.

## Impact
The following connections may be affected when using the default CA trust configuration:

- **JWKS URL fetching:** An attacker could substitute signing keys returned by a configured JWKS endpoint, potentially allowing forged authentication tokens to be accepted and unauthorized access to synced data.
- **TLS connections to non-PostgreSQL source databases:** An attacker could impersonate a database endpoint, potentially exposing credentials or database contents, or modifying data received by PowerSync.
Exploitation requires an attacker to intercept or redirect the affected connection and present a certificate signed using a compromised intermediate CA key.

**PostgreSQL connections are not affected by this issue under the default configuration**, because PowerSync uses a separate CA bundle for PostgreSQL that does not include the affected trust anchors. Deployments using PostgreSQL may still be affected through JWKS fetching.

Deployments using custom CA configurations depend on the contents of their configured trust stores.

## Patches

### PowerSync Cloud
There is no action required for PowerSync Cloud customers. All instances will be automatically updated, and the fix has been backported to Team and Enterprise customers using Service Version Locking.

### Self-Hosting
Upgrade to **PowerSync Service v1.27.1 or later** and redeploy all service containers.

Version 1.27.1 updates the Docker image’s system CA certificates and configures Node.js to use an updated Mozilla CA bundle that removes trust paths to the compromised intermediates.

The remediation is in the Docker image. Users building custom images or running the service outside the official image must also ensure that the CA trust store actually used by Node.js has been updated.

## Workarounds
Avoiding public networks for the JWKS and database connections can mitigate the issue.

## References
- [PowerSync remediation: PR #854](https://github.com/powersync-ja/powersync-service/pull/854)
- [eMudhra intermediate CA compromise: incident details and mitigations](https://emudhra.we-have-a-problem.com/)