Skip to main content
Version: current [26.x]

Security Bulletin 2026-11-03-02

Abstract​

Dremio makes outbound TLS connections to data sources, object stores, identity providers and AI services. These connections are validated against the trust bundles packaged in Dremio containers and executor images: the Java trust store and the operating system certificate bundle. The private keys of eight eMudhra intermediate certificate authority (CA) certificates were incorrectly generated and can be recovered from the certificates themselves. Anyone holding one of these keys can issue a certificate for any hostname that a client trusting the affected root certificates will accept. An attacker with such a key and a position on the network path of Dremio's outbound connections could impersonate those services and read or alter credentials and data. For Java runtimes, which Dremio services and the open source Java-based drivers use, the issue is tracked as CVE-2026-114820. The incident is also tracked as CVE-2026-111943 for the Go standard library. Dremio's own Go-based components are not affected; the open source Arrow Flight SQL ADBC Go driver, used by the Power BI connector (ADBC), is covered under Client Drivers and Connectors.

Dremio has removed the affected roots from the trust bundles in Dremio Software container images and Dremio Cloud. Tarball and RPM installs and most client drivers use your own Java runtime or operating system trust store; see Mitigation Guidance. No exploitation has been publicly reported.

CVSS Qualitative Rating​

Affected Roots​

The compromised intermediates chain to the following roots, either directly or through Sectigo cross-signed certificates:

  • emSign Root TLS CA - G3
  • emSign ECC Root CA - G3
  • AAA Certificate Services (Sectigo)

Affected Releases​

Dremio Software​

  • Container images (Kubernetes and Docker): Dremio Software 26.1.12 and earlier, and Helm chart 3.2.12 and earlier.
  • Tarball and RPM installs: Affected if the Java runtime or operating system certificate bundle used by Dremio still trusts the affected roots.

Dremio Cloud​

  • Dremio Cloud services and Dremio Cloud Classic Executors: Dremio Cloud (EU) before the November 3, 2026 release and Dremio Cloud (US) before the November 4, 2026 release.

Client Drivers and Connectors​

  • Java-based drivers (Arrow Flight SQL JDBC driver, ADBC driver for Java, Tableau JDBC driver): All versions are affected if the client's Java runtime trust store, or a trust store configured for the connection, still trusts the affected roots.
  • Drivers using the operating system trust store (Arrow Flight SQL ODBC driver and ADBC driver for Go): Affected if the client's operating system trust store, or root certificates set for the connection, still trust the affected roots. This applies to all versions of the ODBC driver, and to the ADBC driver for Go in ADBC Libraries 24 and earlier (Go and Python driver packages 1.12.0 and earlier), including when loaded from other languages through the ADBC driver manager.
  • Power BI connectors: The Power BI connector (ADBC) versions 3.16.2 and earlier bundle a certificate list that includes an affected root. The legacy ODBC driver is affected when the connection's Encryption option is set to Enabled-PEM, because Microsoft ships it with a cacerts.pem file that includes an affected root.

Current Mitigation Status​

Dremio Software​

  • Container images (Kubernetes and Docker): Fixed in Dremio Software 26.1.13. The Java runtimes and operating system certificate bundles in the images were updated to remove the affected roots. Go-based components, which are not affected, were also updated as a precaution.
  • Helm chart: Fixed in Helm chart 3.2.13. The third-party images deployed by the chart were updated.
  • Tarball and RPM installs: Dremio runs on your own Java runtime or operating system, so the fix depends on updating your trust stores. See Mitigation Guidance.

Dremio Cloud​

  • Dremio Cloud services and Dremio Cloud Classic Executors: Fixed in the Dremio Cloud (EU) release of November 3, 2026. The fix for Dremio Cloud (US) is scheduled for the November 4, 2026 release. The affected roots were removed from the trust stores.

Client Drivers and Connectors​

  • Java-based drivers: Do not include their own certificates; they rely on the client's Java runtime trust store. See Mitigation Guidance.
  • Drivers using the operating system trust store: Do not include their own certificates; they rely on the client's operating system trust store. The ADBC driver for Go in ADBC Libraries 25 and later (Go and Python driver packages 1.13.0 and later) is built with Go 1.26.10, which rejects the compromised intermediates on all platforms, regardless of the trust store. See Mitigation Guidance.
  • Power BI connectors: Microsoft expects to finish rolling out an updated Power BI connector (ADBC) by the end of November 2026; connections hosted by Microsoft in the Power BI service are already protected. The legacy ODBC driver is not supported by Dremio, and Microsoft does not plan to release an updated version. See Mitigation Guidance.

Known Impact of the Fix​

Removing these roots also removes trust in unaffected certificates that chain to them. This mainly affects AAA Certificate Services, which is widely used. After the fix is applied, connections to a data source, object store, identity provider, or other service whose certificate chains only to one of these roots will fail TLS validation. If this happens, ask the service's operator to serve a certificate chain to a different trusted root.

Mitigation Guidance​

Dremio Software​

  • Kubernetes and Docker: Upgrade to Dremio Software 26.1.13 or later with Helm chart 3.2.13 or later. Upgrading is the only supported way to remove the affected roots from Dremio container images; the upgrade updates both the Java trust stores and the operating system certificate bundles. Dremio Software 25.x is out of support and will not receive a fix.
  • Tarball and RPM: Follow your Java and operating system vendors' instructions to upgrade the Java runtime and the operating system's ca-certificates package, or to remove the affected roots manually (for example, Oracle Security Alert CVE-2026-114820, Distrusting eMudhra Intermediate Certificates in Oracle JDK, OpenJDK). Then restart Dremio.

Dremio Cloud​

  • Dremio Cloud services and Classic Executors: No action is required. Classic Executors switch to the updated image automatically within an hour of the release; restarting engines after the release updates them sooner.

Client Drivers and Connectors​

These apply to both Dremio Software and Dremio Cloud users.

  • Java-based drivers: Follow your Java vendor's instructions to upgrade the client's Java runtime or to remove the affected roots manually (see the examples under Dremio Software). If the connection uses its own trust store, remove the affected roots from it as well. Then restart the client application.
  • Drivers using the operating system trust store: Follow your operating system vendor's instructions to update the system trust store; on Windows, Microsoft delivers these updates through automatic certificate trust list updates. If the connection sets its own root certificates, remove the affected roots from them. For the ADBC driver for Go, also upgrade to ADBC Libraries 25 or later, which rejects the compromised intermediates even if the operating system trust store has not been updated.
  • Power BI connectors: Install Microsoft's updated Power BI connector (ADBC) when it is released; Power BI Desktop and on-premises gateways need the update. Move from the legacy ODBC driver, which is not supported by Dremio, to the Power BI connector (ADBC). Until you move, if the connection's Encryption option is set to Enabled-PEM, you can replace the driver's cacerts.pem file with a current CA bundle, such as the curl CA bundle dated 2026-10-20 or later.

Verifying Protection​

These checks apply to Dremio Software deployments and to client drivers and connectors, including those used with Dremio Cloud. Dremio Cloud services do not need to be checked.

  • From the machine or container that makes the connection, and using the same runtime, connect to https://dv-g3b-emudhra.we-have-a-problem.com/ and https://dv-g3b-aaa-emudhra.we-have-a-problem.com/. The client is protected only if both connections fail with a certificate error. For Java-based components, a curl test checks the operating system bundle, not the Java trust store.
  • These hosts don't test emSign Root TLS CA - G3. To confirm it was removed, check that it no longer appears in the Java trust store or operating system certificate bundle.
  • Behind a TLS-intercepting proxy, the result reflects the proxy's trust store, not the client's.

References​