---
id: "CVE-2026-116641"
kind: "vulnerability"
aliases: ["CVE-2026-116641"]
title: "DB Tools: Go TLS trust store lacks eMudhra CA denylist entries"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["db-tools", "golang", "other", "tls"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-28T22:17:12+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116641", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# DB Tools: Go TLS trust store lacks eMudhra CA denylist entries

DB Tools 100.19.0 was built with Go 1.26.8, which does not block certificates issued by the eMudhra certificate authorities, a list that Go 1.27.3 adds. The sources do not describe a concrete attack path beyond that gap in certificate trust checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the DB Tools version in the installed application; versions up to `100.19.0` are listed as affected
- Confirm which Go toolchain the build used; `1.26.8` is listed as lacking the check
- unknown

## Fix

- Update DB Tools to `100.20.0`, which is built with Go `1.27.3`

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116641

## From the sources

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list.




DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check.




The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_