https://seclists.org/oss-sec/2026/q4/410: Information for Python users garding eMudhra / emSign CA certificate security incident
Published Oct 27, 2026
·Updated
Affected Software
6 affected components
pypi/certifi<2026.10.19
pypi/pip<26.2.2
pypi/uv<0.13.4
pypi/sigstore<4.5.1
conda/conda<26.9.4
pixi/pixi<0.82.1
Frequently Asked Questions
1
Is distrusting the affected certificates in the operating system trust store sufficient for pip?
No. pip loads CA certificates from its vendored certifi bundle in addition to the system trust store, so pip versions earlier than 26.2.2 continue to trust the compromised intermediate CAs even after OS-level distrust changes.
2
What remediation is required for pip users?
Update pip to version 26.2.2 or later. REQUESTS_CA_BUNDLE, --cert, and truststore do not disable pip's bundled certifi trust; they only add CAs or operate alongside certifi.