Our security team has assessed four recently disclosed vulnerabilities against all Lightbits products. Lightbits is not affected by the PHP and Node.js flaws, and the eMudhra/emSign certificate compromise does not affect internal cluster communication.
CVE-2026-111943: Compromised eMudhra/emSign Intermediate Certificates
Internal cluster communication is not affected. By default, internal paths (the management API, etcd, inter-service traffic and storage data paths) use certificates generated at installation from each cluster’s own Certificate Authority. These paths do not rely on the public certificate trust store.
Customer-supplied certificates. Lightbits supports using your own certificates instead of the ones generated at installation. If you do, verify that they do not chain to an affected eMudhra/emSign CA. If they do, reissue them from an unaffected CA.
Optional external integrations. The only components that consult the public trust store are outbound connections to services you may have configured: an external Identity Provider (OIDC, Okta or ADFS) for federated login, and external object storage for backups. If you use neither, this does not apply to you.
Risk where applicable. Exploitation would require an attacker to hold a privileged man-in-the-middle network position and to possess one of the compromised keys. We consider exploitation unlikely, but the potential impact is high.
Remediation. As a defense-in-depth measure, we are preparing maintenance builds that:
- update our Go toolchain to a release that distrusts the affected certificates, and
- refresh the operating system trust store in our product images.
We will share versions and timing in a follow-up. If you use an external Identity Provider or external backup storage, or certificates that chain to an affected CA, plan to apply the update when it is available.
CVE-2026-109618 and CVE-2026-109619: PHP Remote Code Execution
Not affected. No PHP interpreter or runtime is shipped or executed in any Lightbits product.
CVE-2026-111497: Node.js Remote Code Execution
Not affected. No Node.js runtime is shipped or executed in any Lightbits product.
Questions?
If you are unsure whether your deployment uses customer-supplied certificates or external integrations, contact the Lightbits Customer Success Team: support@lightbitslabs.com