Dapr 1.16.21
This update contains the following security fix:
Security: Compromised eMudhra intermediate CA keys were trusted for outbound TLS
Problem
The private keys of eight eMudhra intermediate CA certificates were compromised and reported to the browser root programs on October 17, 2026. Anyone holding one of these keys can issue a TLS certificate for any domain that Go programs accept as valid. Dapr 1.16.20 and earlier were built with Go 1.26.6, which still trusts certificate chains through these intermediates.
Impact
You were affected if daprd makes outbound TLS connections that are verified against the system trust store, such as components connecting to cloud services or service invocation to external HTTPEndpoints. An attacker holding one of the keys and able to intercept that traffic could impersonate the remote service and read or change the data sent to it. mTLS between sidecars and the control plane uses Dapr's own CA and is not affected. According to the Chrome Root Program, no website certificate chaining to these intermediates had been logged to Certificate Transparency before they were blocked.
Root Cause
Go's crypto/x509 verifier does no revocation checks, so the compromised intermediates stayed trusted until Go itself blocked them.
Solution
Dapr is now built with Go 1.26.10, whose crypto/x509 package rejects any certificate chain that passes through the compromised keys.
