Python users must upgrade pip after eMudhra CA key failure

Python TLS clients and package installers that ship the certifi CA bundle need immediate upgrades after a security incident left eight eMudhra intermediate certificates with trivially weak private keys.

Seth Larson reported that the emSign root had to be removed from certifi and similar bundles. Leaving the bad intermediates trusted would expose clients to man-in-the-middle attacks on TLS. Floor versions are certifi 2026.10.19, pip 26.2.2, uv 0.13.4, and sigstore 4.5.1. Container images should be rebuilt so they pick up current system certificates.

Christian Heimes stressed that pip users must update the tool itself. Pip always loads its vendored certifi in addition to the system trust store, and there is no supported way to disable that. Certificate environment variables and command-line options only add authorities; they do not replace certifi. Any pip older than 26.2.2 therefore keeps trusting the compromised intermediates even when the operating system has already distrusted them. uv users can fall back on the system store with UV_SYSTEM_CERTS enabled; that option does not exist for pip.

The failure was cryptographic rather than a conventional CA breach. All eight eMudhra CAs used elliptic-curve private keys whose scalar d was less than 256, including at least one key with d equal to 4.

Because an older pip could itself be the attack target during an upgrade, Larson advised obtaining the new wheel through a browser whose certificate store has already been refreshed, verifying the published SHA-256 checksum, and only then bootstrapping certifi and other tools. CPython’s ensurepip bootstrap is being updated in forthcoming interpreter security releases so new virtual environments ship a fixed pip; until those land, upgrading pip after every venv creation remains the practical workaround.