Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943.
Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters.
No components marked as affected
Resolved
Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943.
Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters.
Identified
We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless).
For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed.
For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
Identified
We are responding internally to CVE-2026-111943 related to compromised root certificates.
We have assessed Redpanda Cloud and have remediated any clusters secured with mTLS and have mitigated any other potential impacted vectors. We have also patched all Golang runtimes.
We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless).
For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed.
For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
