All Systems are up and running
This page provides a real-time overview of Mendix system status, details on upcoming scheduled maintenance, and a record of past incidents. Refer to the documentation for more information.
Security update: compromised eMudhra certificates blocked for Mendix Cloud apps
Incident
Report for Mendix Technology
Subscribe to Updates
Monitoring
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
1. Test environment
2. Acceptance environment
3. Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
1. Test environment
2. Acceptance environment
3. Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
This incident affects: Mendix Cloud Regions (Mendix Cloud US-East, Mendix Cloud EU (Frankfurt), Mendix Cloud Asia Pacific (Tokyo), Mendix Cloud Free Tier EU, Mendix Cloud UK, Mendix Cloud IE, Mendix Cloud US-West, Mendix Cloud Asia Pacific (Sydney), Mendix Cloud Canada (Central), Mendix Cloud Asia Pacific (Singapore), Mendix Cloud Asia Pacific (Mumbai), Mendix Cloud Africa (Cape Town), Mendix Cloud South America (São Paulo), Mendix Cloud EU (Frankfurt 2), Mendix Cloud Asia Pacific (Osaka), Mendix Cloud Asia Pacific (Seoul), Mendix Cloud Asia Pacific (Jakarta), Mendix Cloud EU (Frankfurt): GenAI Resources, Mendix Cloud Canada (Central): GenAI Resources) and Mendix Cloud Dedicated Regions (Mendix Cloud Dedicated US-West Echo, Mendix Cloud Dedicated UK Echo, Mendix Cloud Dedicated Asia Pacific (Singapore) Echo, Mendix Cloud Dedicated US-East Hotel, Mendix Cloud Dedicated US-East Mike, Mendix Cloud Dedicated US-East Papa, Mendix Cloud Dedicated EU (Frankfurt) Sierra, Mendix Cloud Dedicated EU (Frankfurt) Uniform, Mendix Cloud Dedicated Asia Pacific (Singapore) Able, Mendix Cloud Dedicated US-East Kilo, Mendix Cloud Dedicated US-East Charlie, Mendix Cloud Dedicated US-East Colin, Mendix Cloud Dedicated EU (Frankfurt) Metro).