Resolved after 7 hours 50 minutes, on October 22, 2026.
Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943: https://nvd.nist.gov/vuln/detail/cve-2026-111943. Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters.
Update timeline
- identified Oct 22, 2026, 05:38 PM UTC
We are responding internally to CVE-2026-111943 related to compromised root certificates. We have assessed Redpanda Cloud and have remediated any clusters secured with mTLS and have mitigated any other potential impacted vectors. We have also patched all Golang runtimes. We will be rolling out updated truststores/images across our fleet in due course which may necessitate a rolling restart of Redpanda brokers, however we are currently assessing the impact to Redpanda Cloud as CVSS 6.5 (Medium). For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
- identified Oct 22, 2026, 08:44 PM UTC
We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless). For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed. For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
- resolved Oct 23, 2026, 01:29 AM UTC
Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943: https://nvd.nist.gov/vuln/detail/cve-2026-111943. Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters.
Your product runs on more than Redpanda
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services