Task
Version · 6.0.1
Troubleshoot

Remediate CVE-2026-91403 and CVE-2026-114820 in the Liquibase Secure Java runtime

Last updated: November 3, 2026

CVE-2026-91403 and CVE-2026-114820 affect the Java runtime in Liquibase Secure 6.0.0 and earlier. Liquibase Secure 6.0.1 includes the fix. If you can't upgrade yet, how you remove the compromised eMudhra certificates depends on how you installed Liquibase Secure on Windows, Linux, or macOS.

Before you begin

Find how you installed Liquibase Secure:

Windows installer: Liquibase Secure runs on the Java runtime that ships with it, in the jre folder of the installation directory. By default, that is C:\Program Files\liquibase-secure\jre. Follow the steps on this page.
ZIP or TAR.GZ file, on Windows, Linux, or macOS: Liquibase Secure runs on your own Java installation. Update it to a JDK that includes JDK-8395142 and JDK-8395690 and that no longer trusts emSign Root CA - G1. You don't need the steps on this page.
Docker image: upgrade to Liquibase Secure 6.0.1 or later. You don't need the steps on this page.
Liquibase Secure Server: upgrade to Liquibase Secure Server 6.0.1 or later. You don't need the steps on this page.

Before you run the steps on this page, make sure that:

The JAVA_HOME environment variable is not set. When JAVA_HOME is set, Liquibase runs on that Java installation instead of the bundled runtime, so these steps don't change the Java that Liquibase uses. Update that Java installation to a release that includes the fix instead.
You can open PowerShell as an administrator.
You know which TLS endpoints Liquibase connects to, such as your databases, and which root certificate authority each one chains to. If your Java runtime includes the AAA Certificate Services root, the procedure removes it, so a connection to a server whose certificate chains only to that root fails afterward.

Procedure

Save the remediation script

Copy the following script into a file named distrust-emsign.ps1 and save it on the machine where Liquibase Secure is installed.

<#
.SYNOPSIS
Distrusts the compromised eMudhra CA in a Java runtime (CVE-2026-91403, CVE-2026-114820).

.DESCRIPTION
Removes the emSign root certificates from the runtime's cacerts (and the Comodo AAA root,
on runtimes that include it) and adds the compromised eMudhra intermediate certificates to
its blocked.certs, following the OpenJDK fix. Safe to run more than once. Run from an
elevated (Administrator) prompt when the runtime is under Program Files.

.PARAMETER JavaHome
The Java runtime to fix. For a Liquibase Secure Windows installation this is the "jre"
folder inside the installation directory. Defaults to $env:JAVA_HOME.

.EXAMPLE
powershell -ExecutionPolicy Bypass -File distrust-emsign.ps1 -JavaHome "C:\Program Files\liquibase-secure\jre"
#>
param(
    [string]$JavaHome = $env:JAVA_HOME
)

$ErrorActionPreference = 'Stop'

if (-not $JavaHome) { throw 'Pass -JavaHome or set JAVA_HOME.' }
$store = Join-Path $JavaHome 'lib\security\cacerts'
$blocked = Join-Path $JavaHome 'lib\security\blocked.certs'
$keytool = Join-Path $JavaHome 'bin\keytool.exe'
if (-not (Test-Path $keytool)) { $keytool = Join-Path $JavaHome 'bin/keytool' }
foreach ($f in $store, $blocked, $keytool) {
    if (-not (Test-Path -LiteralPath $f)) { throw "Not found: $f. Is $JavaHome a Java runtime?" }
}

$text = [IO.File]::ReadAllText($blocked)
if (-not $text.StartsWith('Algorithm=SHA-256')) { throw "Unexpected format in $blocked" }

Write-Host "Java runtime: $JavaHome"

# Temurin (Mozilla) and OpenJDK alias spellings
$roots = 'emsign|aaa_certificate_services|comodoaaaca'

# keytool output is localized; the alias parsing below expects English
$english = '-J-Duser.language=en', '-J-Duser.country=US'

function Get-Aliases {
    $out = & $keytool @english -list -cacerts -storepass changeit
    if ($LASTEXITCODE -ne 0) { throw "keytool could not read $store" }
    $entries = @($out | Where-Object { $_ -match 'trustedCertEntry' })
    if ($entries.Count -eq 0) { throw "No certificates found in keytool's listing of $store" }
    $entries | ForEach-Object { ($_ -split ', ')[0] }
}

Write-Host "Removing compromised root certificates from $store"
$found = @(Get-Aliases | Where-Object { $_ -match $roots })
foreach ($alias in $found) {
    & $keytool @english -delete -cacerts -storepass changeit -alias $alias
    if ($LASTEXITCODE -ne 0) { throw "keytool could not remove $alias (run as Administrator?)" }
    Write-Host "  Removed $alias"
}
$left = @(Get-Aliases | Where-Object { $_ -match $roots })
if ($left.Count -gt 0) { throw "Compromised roots still present in ${store}: $($left -join '; ')" }
if ($found.Count -eq 0) { Write-Host '  None present (already removed)' }
else { Write-Host "  Removed $($found.Count) root certificates" }

# SHA-256 fingerprints of the compromised eMudhra intermediate certificates,
# as OpenJDK added them to blocked.certs (JDK-8395142): 16 certificates, each
# fingerprinted in its alternate DER encodings
$fingerprints = @(
    '0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19'
    '10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B'
    '169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240'
    '21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832'
    '33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09'
    '37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8'
    '3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829'
    '3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF'
    '42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493'
    '432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3'
    '45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE'
    '4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1'
    '4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C'
    '50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A'
    '558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB'
    '579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512'
    '59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66'
    '5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE'
    '5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699'
    '62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72'
    '7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489'
    '75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536'
    '7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2'
    '84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD'
    '8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0'
    '8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82'
    '912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1'
    '98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B'
    '9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4'
    '9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7'
    'A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC'
    'A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5'
    'A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC'
    'A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8'
    'A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8'
    'A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9'
    'AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986'
    'B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C'
    'B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD'
    'C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0'
    'C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222'
    'C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33'
    'CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F'
    'CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978'
    'D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8'
    'E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838'
    'EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E'
    'FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F'
)

Write-Host "Blocking compromised intermediate certificates in $blocked"
# Keep the file's line endings and write plain ASCII (no byte-order mark)
$eol = if ($text.Contains("`r`n")) { "`r`n" } else { "`n" }
$present = @{}
foreach ($line in ($text -split "`r?`n")) { $present[$line.Trim().ToUpperInvariant()] = $true }
$missing = @($fingerprints | Where-Object { -not $present.ContainsKey($_) })
if ($missing.Count -gt 0) {
    $append = ''
    if (-not $text.EndsWith("`n")) { $append = $eol }
    $append += ($missing -join $eol) + $eol
    [IO.File]::AppendAllText($blocked, $append, [Text.Encoding]::ASCII)
}

$after = [IO.File]::ReadAllText($blocked) -split "`r?`n" | ForEach-Object { $_.Trim().ToUpperInvariant() }
$notBlocked = @($fingerprints | Where-Object { $after -notcontains $_ })
if ($notBlocked.Count -gt 0) { throw "$($notBlocked.Count) fingerprints missing from $blocked" }
if ($missing.Count -eq 0) { Write-Host "  All $($fingerprints.Count) fingerprints present (already blocked)" }
else { Write-Host "  Added $($missing.Count) of $($fingerprints.Count) fingerprints" }
Write-Host "Done: $JavaHome no longer trusts the compromised eMudhra CA."

Back up the truststore files

In the jre\lib\security folder of your Liquibase Secure installation directory, copy cacerts and blocked.certs to a safe location. The script doesn't back up these files, and you need these copies to roll back the change.

Run the script

Open PowerShell as an administrator, go to the folder where you saved the script, and run it against the Liquibase Secure Java runtime.

Be sure to:

Replace C:\Program Files\liquibase-secure\jre with the jre folder in your installation directory if you installed Liquibase Secure somewhere else.

powershell -ExecutionPolicy Bypass -File distrust-emsign.ps1 -JavaHome "C:\Program Files\liquibase-secure\jre"

The script removes the emSign root certificates from cacerts, and the AAA Certificate Services root if your Java runtime includes it, and adds the compromised eMudhra certificates to blocked.certs. If any of the affected root certificates remain, it stops with an error.

When the script succeeds, it prints the Java runtime it updated, a Removed line for each root certificate it deletes, the number of fingerprints it added to blocked.certs, and a Done line. For example:

Java runtime: C:\Program Files\liquibase-secure\jre
Removing compromised root certificates from C:\Program Files\liquibase-secure\jre\lib\security\cacerts
  Removed cn_emsign_ecc_root_ca__c3,o_emudhra_inc,ou_emsign_pki,c_us [jdk]
  Removed cn_emsign_ecc_root_ca__g3,o_emudhra_technologies_limited,ou_emsign_pki,c_in [jdk]
  Removed cn_emsign_root_ca__c1,o_emudhra_inc,ou_emsign_pki,c_us [jdk]
  Removed cn_emsign_root_ca__g1,o_emudhra_technologies_limited,ou_emsign_pki,c_in [jdk]
  Removed 4 root certificates
Blocking compromised intermediate certificates in C:\Program Files\liquibase-secure\jre\lib\security\blocked.certs
  Added 48 of 48 fingerprints
Done: C:\Program Files\liquibase-secure\jre no longer trusts the compromised eMudhra CA.

Always pass -JavaHome. If you leave it out, the script updates the Java installation in JAVA_HOME, not the Java runtime that ships with Liquibase Secure.

Test Liquibase

Run a Liquibase command that connects to your database, such as liquibase status. Liquibase uses the updated truststore the next time it starts, so restart any Liquibase process that was already running.

If the command fails with a certificate error such as PKIX path building failed or unable to find valid certification path to requested target, a server Liquibase connects to depends on a removed root certificate. Restore the cacerts and blocked.certs files you backed up, then contact Liquibase Support.

PreviousInstallation troubleshooting NextResolve apt-get install errors for Liquibase on Debian or Ubuntu

Download Liquibase Secure 6.0.1 or later

VEX files for Liquibase Secure

CVE-2026-91403

CVE-2026-114820