JetBrains is responding to the industry-wide eMudhra Certificate Authority (CA) security incident, which affects certificate trust in a number of software products and development environments, including several JetBrains products. Our Security and product teams are working to address the impact and release security updates. We recommend that customers keep their JetBrains products, operating systems, and development environments up to date and follow the guidance below.
What Happened
On October 17, 2026, a security researcher reported that private keys associated with eight eMudhra intermediate certificate authorities could be recovered because of weaknesses in how they were generated.
These weaknesses could allow an attacker to create certificates that appear trusted by systems that continue to accept the affected certificate chains.
Browser and operating system vendors have taken steps to block the affected certificates. However, applications that use separate or bundled certificate trust stores may require additional updates.
JetBrains Impact
Our Security and product teams have been assessing the impact across the JetBrains product portfolio. We have identified that this incident affects multiple products, including our IDEs, Toolbox App, TeamCity, YouTrack, Hub, and other developer tools.
We are not aware of any exploitation of this issue against JetBrains customers.
Many JetBrains products, both desktop and on-premises as well as our cloud services, run on Java, including our IDEs, which use JetBrains Runtime (our build of the Java runtime). JetBrains Runtime, like other Java runtimes such as Oracle JDK, OpenJDK, and Amazon Corretto, trusted the affected certificates.
We are prioritizing remediation based on severity and potential customer impact and releasing updates as fixes become available.
Security Updates and Infrastructure Status
We are working on security updates for all affected distributable JetBrains products and tools. The table below shows which updates are already available and which are still in progress.
JBR 21: 21.0.11b1163.125, 21.0.9b1038.91.
See GitHub releases
Please check user-uploaded certificates.
For Docker, deploy the updated images when they are published and recreate the containers.
You can also patch existing images using these instructions.
Detailed instructions will follow in a separate blog post.
Latest Docker images jetbrains/youtrack and jetbrains/youtrack-windows.
Not fixed yet: linter images (2026.2 and older) and Qodana CLI (2026.2.2)
Linters and CLI: update when fixed versions are published.
Set Node.js 24.22.1 or later explicitly in your Gradle build script, see Change Node.js version.
If you use the Node.js toolchain service, first set kotlin.js.nodeJsToolchainMode=disable in gradle.properties.
Update the Java runtime you use.
If you build your own IDE based on MPS, rebuild it on the fixed MPS version so that it gets the updated Java runtime and embedded browser.
For older MPS versions, remove the two root certificates from the bundled Java runtime as described below.
For JetBrains cloud services, we are updating our cloud services and infrastructure on an ongoing basis, including JetBrains Air, Qodana Cloud, TeamCity Cloud, YouTrack Cloud, Datalore and JetBrains AI services. For these services, no action is required from customers. One exception: TeamCity Cloud customers who use self-hosted build agents should check the Java runtime on those agents and update it if needed.
Our teams are continuing remediation work across other affected products. We will update this post with product-specific guidance as fixes become available.
What Customers Should Do
We recommend that customers take the following steps:
Install available JetBrains security updates. Update affected products to the latest patched versions as they become available.
Keep operating systems and runtimes updated. Apply the latest security updates from operating system and runtime vendors, including certificate trust store updates. For additional technical guidance, see the eMudhra incident recommendations for developers.
Follow product-specific guidance. For products where security updates are not yet available, follow the recommended mitigation steps provided in JetBrains security advisories and product documentation.
If you cannot update the product right now, update the Java runtime it uses. If that is not possible either, remove the two root certificates at the top of all affected chains, emSign ECC Root CA – G3 and AAA Certificate Services, from that Java runtime’s trust store, or point the product to a copy of the trust store without them. Also update your OS ca-certificates package, since many tools trust the system certificate store too.
Disabling certificate validation altogether or otherwise weakening the certificate verification mechanisms as a workaround is NOT recommended.
What’s Next
Our security and product teams are continuing to review certificate trust across affected JetBrains products and preparing additional security updates where needed.
We will update this post as fixes become available and publish version-specific guidance through our product release notes and security advisories.
