Apple macOS developer tools still trust compromised eMudhra certificates

Apple has failed to patch a critical certificate trust issue in its developer tools as of late October 2026. Despite being notified of the compromise on October 17, the company’s latest operating system update, macOS 27.2, released on October 26, did not resolve the vulnerability and even reversed manual fixes applied by users. This leaves developers using standard command-line tools like git, curl, and python3 exposed to potential man-in-the-middle attacks.

What happened

The core issue involves digital certificates issued by eMudhra, a certificate authority that suffered a security compromise. When a certificate authority is compromised, attackers can create fake certificates for any website, including major code hosting platforms like GitHub. These fake certificates allow attackers to intercept encrypted traffic without triggering standard security warnings. While Apple quickly updated Safari and other applications built on its native networking frameworks to distrust these specific certificates, it neglected the standalone developer tools bundled with the operating system.

Consequently, tools such as git, curl, and python3 continue to trust the compromised eMudhra root certificates. This creates a significant risk for software development workflows. When a developer clones a repository or pushes code using HTTPS, their tooling relies on these certificates to verify the identity of the remote server. If the certificates are trusted despite being compromised, an attacker positioned on the network path can impersonate GitHub or other services. This allows them to serve malicious code during a clone operation or steal credentials, such as personal access tokens, during authentication.

The situation was exacerbated by the release of macOS 27.2. Many security-conscious developers had manually removed the compromised certificates from their system trust stores to protect themselves. However, this operating system update reset the certificate store, effectively undoing the manual workaround and leaving these users vulnerable again. In contrast, many other open-source projects and volunteer-maintained distributions shipped fixes within days of the initial notification, highlighting a disparity in response times between community-driven efforts and Apple’s handling of its developer toolchain.

Key details

• Apple was officially notified of the eMudhra certificate compromise on October 17, 2026.
• As of October 28, 2026, macOS developer tools including git, curl, and python3 still trust the compromised certificates.
• The macOS 27.2 update, released on October 26, 2026, failed to fix the issue and reverted manual user workarounds.
• Attackers can intercept HTTPS connections, potentially altering code during git clones or stealing credentials.
• Safari and apps using Apple’s native networking framework are protected, but command-line tools are not.
• Users must re-apply manual fixes after every macOS update until an official patch is released.

Background

To understand the severity of this issue, it helps to know how secure web connections work. When you connect to a website via HTTPS, your computer checks the site’s digital certificate to ensure it is legitimate. This certificate is signed by a Certificate Authority (CA), a trusted third party. Your operating system maintains a list of trusted CAs. If a CA is compromised, as eMudhra was, attackers can issue valid-looking certificates for domains they do not own. This breaks the chain of trust, allowing them to decrypt and modify traffic that appears secure to the user.

Developer tools like git and curl rely on the system’s certificate store to verify connections to code repositories. Unlike web browsers, which often have their own certificate stores or update mechanisms, these command-line tools typically use the underlying operating system’s trust store. On macOS, this means they look at the same list of trusted roots that the system uses. If Apple removes a bad certificate from Safari but leaves it in the system store used by git, developers remain at risk. This distinction between browser-level protections and system-level tooling is crucial for understanding why some apps are safe while others are not.

Why it matters

For teams that run their own software or manage internal infrastructure, this vulnerability represents a direct supply chain threat. If a developer clones a repository while on an untrusted network, such as public Wi-Fi or a compromised corporate network, an attacker could inject malicious code into the project. This code might look legitimate but could contain backdoors, crypto miners, or data exfiltration scripts. Since the attack happens during the download process, standard code reviews might miss the injection if the attacker modifies the code before it reaches the developer’s machine.

Furthermore, the interception of credentials poses a severe risk to account security. GitHub tokens and other API keys sent over HTTPS are usually safe from eavesdropping. However, with a trusted but compromised certificate, an attacker can decrypt this traffic in real-time. This allows them to steal authentication tokens, which can then be used to access private repositories, modify production environments, or escalate privileges within an organization. For DevOps engineers managing CI/CD pipelines, this risk extends to automated runners that may also be using affected macOS versions.

The reversal of manual fixes by macOS updates adds an operational burden to security teams. It is not enough to apply a fix once; teams must now verify the integrity of their certificate stores after every operating system update. This increases the likelihood of human error, where a developer assumes they are protected because they applied a fix previously, only to be exposed again by a silent system update. This uncertainty undermines confidence in the platform’s security posture and requires constant vigilance.

What you can do

• Test your git installation by running the verification command provided by security researchers to check if it rejects the compromised certificate.
• Test your curl installation by attempting to connect to the test domains hosted by the security community to confirm protection.
• Manually remove the compromised eMudhra root certificates from your macOS system keychain if they are still present.
• Re-verify your certificate trust store after every macOS update, as system updates may restore the compromised certificates.
• Avoid cloning repositories or pushing code over HTTPS on untrusted networks until Apple releases an official fix.
• Consider using SSH for git operations instead of HTTPS, as SSH uses a different trust model that is not affected by this certificate issue.