eMudhra Security Incident - CVE-2026-114820 impact on RTI Connext products

The security and integrity of the systems built using RTI Connext products is important to us.  Periodically we will inform you of any newly identified vulnerabilities in our software on our RTI Connext Security Bulletins and Advisories page.

Summary

The following RTI applications may be affected by the eMudhra certificate authority vulnerability when establishing secure outbound connections:

• System Designer: Versions 7.7.*

• Admin Console: Versions 7.3.* and 7.7.*

• Launcher: Versions 6.1.* ,  7.3.* and 7.7.*

No other RTI products have been identified as affected by the application-specific issue. Customers using Connext container images published on RTI's Docker Hub may also be affected when using other applications or utilities, such as curl, that establish outbound TLS connections.

Details

Certain Connext products bundle Java Runtime Environment (JRE) and Node.js components that may contain certificate trust stores affected by the eMudhra vulnerability (CVE-2026-114820, CVE-2026-91403  and Node.js disclosure). Exposure is limited to specific outbound TLS connections involving the affected certificate authorities, and the presence of these components does not necessarily indicate a security risk.

The identified application-level exposure is limited to System Designer, Admin Console, and Launcher when establishing secure outbound connections under conditions involving the affected certificate authorities.

Connext container images from RTI's Docker Hub may also contain affected CA certificate stores and dependencies, including Python, pip, and certifi, that continue to trust the affected eMudhra certificate authorities.

The potential risk arises when a container establishes outbound TLS connections and certificate validation relies on the affected trust configuration.

Mitigation

RTI Upgrades

An upgrade of the affected components is planned for the latest LTS release in an upcoming security patch. For Connext 7.3.1 LTS, RTI plans to provide an updated JRE to replace the bundled version.

Mitigation Before Upgrading

• System Designer, Launcher, and Admin Console: Prevent these applications from establishing outbound TLS connections. These connections are not required for normal operation.

• Connext container images: Avoid using other applications or utilities that establish outbound TLS connections. If such connections are required, update the affected OS trust stores and any application-specific certificate stores or dependencies, as applicable.