---
id: "CVE-2026-108014"
kind: "vulnerability"
aliases: ["CVE-2026-108014"]
title: "HCL Domino: compromised eMudhra CA keys let attackers spoof TLS servers"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["certificates", "hcl-domino", "self-hosted", "tls", "vendor"]
not_affected_if: ["no-emudhra-trust", "no-outbound-requests"]
published_at: "2026-10-27T17:16:57+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:34:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108014", "first_seen_at": "2026-10-27T17:32:45+00:00"}]
---

# HCL Domino: compromised eMudhra CA keys let attackers spoof TLS servers

Private keys for eight eMudhra intermediate CA certificates were compromised, so the certificates no longer protect trust. An unauthenticated network attacker can use them to impersonate servers and intercept or modify outbound TLS connections from HCL Domino Server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the HCL Domino Server runs outbound network request features that rely on the trusted CA store, using the server's own configuration (unknown if the sources give a specific setting)
- Check whether eMudhra intermediate CA certificates are present in the trust store used by Domino, for example by listing the issuer chain of outbound connections (unknown if the sources give a command)

## Fix

- Follow the HCL and eMudhra advisories for the affected certificates and the fixed HCL Domino release (unknown: the sources do not name versions)
- Remove or distrust the eight compromised eMudhra intermediate CA certificates from the Domino trust store once the vendor instructs it (unknown: the sources do not give the exact steps)

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108014

## From the sources

Private keys for eight eMudhra intermediate CA certificates have been  compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_