Ongoing since 05:38 PM UTC.
We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless). For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed. For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
Update timeline
- identified Oct 22, 2026, 05:38 PM UTC
We are responding internally to CVE-2026-111943 related to compromised root certificates. We have assessed Redpanda Cloud and have remediated any clusters secured with mTLS and have mitigated any other potential impacted vectors. We have also patched all Golang runtimes. We will be rolling out updated truststores/images across our fleet in due course which may necessitate a rolling restart of Redpanda brokers, however we are currently assessing the impact to Redpanda Cloud as CVSS 6.5 (Medium). For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
- identified Oct 22, 2026, 08:44 PM UTC
We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless). For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed. For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
Your product runs on more than Redpanda
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services