Home Assistant OS 18.4 and the eMudhra breach: what's fixed, what isn't
- News
- Rocks on Galaxy
- Maison connectee
- 28 Oct, 2026
- 0
When eight eMudhra certificate authority keys turned out to be recoverable on October 17, 2026, Chrome blocked them in under two hours and Firefox the same evening. Your Home Assistant box took longer. Its operating system, its Supervisor and several of its official apps each carry their own copy of the list of trusted certificate authorities, and each had to be rebuilt separately. Ten days later, with Home Assistant OS 18.4 out since October 27, most of the stack is fixed, but not all of it.
This guide does three things. It retraces the timeline, shows layer by layer what is patched as of October 28, and walks you through a safe update, including how to check a downloaded image with Cosign. We ran that check ourselves on the 18.4 release.
Key takeaways
- Home Assistant OS 18.4 (October 27) ships a new CA bundle that drops the eMudhra root behind the compromised intermediates, plus kernel 6.18.58 on most boards and fixes for 18.3's Bluetooth and VLAN regressions.
- Core 2026.10.3, Supervisor 2026.10.4 and the dns, audio, multicast and cli plugins are reported fixed. Mosquitto 7.1.3 is fixed too.
- As of October 28, a community test still found the compromised chain accepted in Matter Server, OpenThread Border Router, Piper, Whisper, NGINX SSL proxy and Terminal & SSH.
- 18.4 release files now include a
SHA256SUMSfile signed with Sigstore. Our Cosign check returned "Verified OK".- Update from Settings with the backup option on. If a USB Bluetooth dongle misbehaves, the previous OS is one command away.
Timeline: from a weak key to Home Assistant OS 18.4
The incident is unusual because the problem was in the keys themselves, not in a hacked server. According to eMudhra's own statement, the eight intermediate CAs were created in a key ceremony on April 30, 2025, and a flawed wrap/unwrap step produced weak keys that were the ones actually published. The problem went unnoticed for about 18 months, through two audit cycles.
- October 17, 18:05 UTC: the Chrome Root Program receives the researcher's report. At 19:45 UTC Chrome pushes a CRLSet update that blocks the keys, per Google's security blog.
- October 17, 22:59 UTC: Mozilla's OneCRL block reaches all Firefox users with standard settings, according to the Mozilla Security Blog.
- October 18: eMudhra revokes all eight intermediates.
- October 20: Mozilla announces NSS 3.131.1, which removes the root (emSign ECC Root CA - G3). Alpine's
ca-certificates20261020-r0 follows, according to the Home Assistant issue cited below. - October 22: Home Assistant's docker-base project merges a change that forces a package upgrade at build time, so rebuilt images pick up the new bundle.
- October 23: Home Assistant Core 2026.10.3 is released. The community report says it is fixed.
- October 24: a user opens Supervisor issue #7424, showing that Supervisor 2026.10.3, its plugins and several official apps still trust the root. Supervisor 2026.10.4 is published the same day and moved to the stable channel on October 26.
- October 27: Chrome's removal of the root is scheduled to roll out. Home Assistant OS 18.4 and Mosquitto 7.1.3 are released.
- October 28 (evening of October 27, US Central time): the reporter confirms the fix on HAOS 18.4 and closes the issue, listing the apps that still accept the chain.
Layer by layer: what is patched on October 28
A Home Assistant OS install is a stack of separate pieces. The host OS has a trust store, and so does every container running on it. Updating one does not update the others. The table below combines the HAOS 18.4 release notes and the tests posted in issue #7424, run on a Raspberry Pi 4. Those tests come from a community member, not from Home Assistant.
| Layer | Version tested | Status | Basis |
|---|---|---|---|
| Host operating system | HAOS 18.4 | Root removed | Official release notes |
| Home Assistant Core | 2026.10.3 and later | Fixed | Community report |
| Supervisor | 2026.10.4 | Fixed (chain rejected) | Report, confirmed by a Home Assistant maintainer |
| Plugins: dns, audio, multicast, cli | 2026.10.0 / 2026.10.1 (cli) | Fixed | Community report |
| Plugin: observer | 2026.08.0 | Could not be checked | Community report |
| Mosquitto broker | 7.1.3 | Fixed | Community report |
| Z-Wave JS | 1.10.0 | Never contained the root | Community report |
| Matter Server, OpenThread Border Router | Current | Still accept the chain | Community report |
| Piper, Whisper, NGINX SSL proxy, Terminal & SSH | Current | Still accept the chain | Community report |
On the morning of October 28 we checked the new standalone GitHub repositories for Matter Server, OpenThread Border Router, Piper, NGINX SSL proxy and Terminal & SSH. None had published a release yet. The reporter expects each app to pick up the fixed base image in its first release from its new repository. That makes sense, but it is an expectation, not a schedule.
The other half of 18.4: Bluetooth, VLANs and boot fixes
Even without the certificate issue, 18.4 is worth installing if 18.3 broke something for you. Home Assistant calls it "a bugfix and security release, mainly addressing kernel regressions found in 18.3". The fixes are not identical on every board.
| Build | Kernel 6.18.58 | RTL8761B Bluetooth fix | Realtek VLAN fix | U-Boot boot fix |
|---|---|---|---|---|
| Raspberry Pi | No | No | Yes | Yes |
| Home Assistant Yellow | No | No | Yes | Yes |
| Home Assistant Green | Yes | Yes | No | Yes |
| Virtual machine (OVA) | Yes | Yes | No | No |
| Generic x86-64 | Yes | Yes | Yes | No |
| Generic aarch64 | Yes | Yes | Yes | No |
| ODROID, Khadas VIM | Yes | Yes | Yes | Yes |
What else changes
- RTL8761B USB Bluetooth adapters (ID 0bda:a728), which stopped working with kernel 6.18.45, work again. Firmware for the RTL8761CU controller is also added.
- On Raspberry Pi, the fast USB storage mode (UAS) is disabled for two enclosures: the Argon ONE M.2 (ASMedia 174c:1156) and the UGREEN 70499 CM300 (ASMedia ASM235CM).
- Security updates for Docker 29.8.2, containerd 2.3.6, Go 1.27.3 and Buildroot 2025.02.19.
- EROFS deduplication is turned off on all boards, and generic x86-64 gains Jasper Lake pin-control support.
How to update safely, step by step
These steps follow Home Assistant's common tasks documentation.
- Note your current version under Settings > About.
- Update the Supervisor and Core first if they are pending, so your apps' base layer is current.
- Open Settings > System > Updates, choose Home Assistant Operating System, leave the backup option on and select Update. From the command line,
ha os updatedoes the same thing. - After the reboot, check Settings > System > Repairs and the logs. If you use a USB Bluetooth dongle or Bluetooth proxies, make sure your BLE devices are reporting again.
- Update your apps over the coming days, especially Matter Server and OpenThread Border Router, as new releases appear.
If the new OS causes a problem, Home Assistant OS keeps the previous version in a second boot slot. ha os info shows which slot is active and what each slot contains. ha os boot-slot other reboots into the previous version. You can also install a specific release with ha os update --version 18.3.
Checking a downloaded image with Cosign: our test
This is new in 18.4: each release now ships SHA256SUMS and a Sigstore bundle, SHA256SUMS.sigstore.json. According to pull request #5053, the file is signed by the project's GitHub build workflow, so there is no long-lived private key to steal. Given how this incident started, that design choice is relevant. It matters if you flash an SD card, an SSD or a VM image yourself. Updates installed from the interface are not affected by this step.
On October 28 we downloaded both files from the 18.4 release and ran Cosign 3.1.4 (see the Sigstore verification docs):
cosign verify-blob \
--bundle SHA256SUMS.sigstore.json \
--certificate-identity "https://github.com/home-assistant/operating-system/.github/workflows/build.yaml@refs/tags/18.4" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMSThe result was Verified OK. The signed file lists 35 images and update bundles. We downloaded one of them, the Khadas VIM3 update bundle, and sha256sum reported OK. The identity we used is the one recorded in the signing certificate: the build.yaml workflow of the home-assistant/operating-system repository, on the 18.4 tag. For a later release, change the tag at the end of the identity.
Home Assistant / compatibility: who is really exposed?
Our analysis: this is a "fix it this week" issue, not a reason to panic. Google says no certificate from these intermediates was logged to Certificate Transparency before the block, and eMudhra says they never issued a single certificate. The risk is different. Because the keys can be recovered, anyone could create new forged certificates. Browsers check Certificate Transparency, but most programs and IoT software do not. They rely only on their own trust store. Attacking a Home Assistant install this way would also require an attacker positioned on the network path, such as a hostile Wi-Fi network, a compromised router or DNS manipulation.
- Home Assistant OS users: install 18.4 and Supervisor 2026.10.4. This covers the host and the components that fetch app repositories and updates.
- Matter and Thread households: Matter Server and OpenThread Border Router are among the apps still waiting. Your local Matter traffic does not depend on public web certificates, but outbound HTTPS from those apps does, so update them as soon as releases appear.
- Container or Core installs: HAOS 18.4 does not apply to you. Make sure Core is on 2026.10.3 or later and that your host's
ca-certificatespackage is current. - Remote access users: Home Assistant Link (the former Cloud) and your own reverse proxy should use certificates from other CAs. The NGINX SSL proxy app is on the list of apps still waiting.
For the bigger picture of how Home Assistant fits together, see our Home Assistant 2026 guide. If Thread matters to you, read our Zigbee vs Matter-over-Thread study. And if cameras are next, see our Matter cameras buyer's guide.
FAQ
Will HAOS 18.4 install automatically?
We found no official statement that it does. Home Assistant shows OS updates as a notification in Settings, and you install them manually or with ha os update. Check that you are actually on 18.4 under Settings > About.
Do I need Cosign for normal updates?
No. Cosign is for checking an image you download and flash yourself, such as a new SD card, an SSD or a virtual machine. The release notes do not say whether in-app updates use the new signatures.
My ASUS Bluetooth dongle (0b05:1bef) acts up on 18.3. Does 18.4 fix it?
Possibly, but it is not confirmed. That dongle is the subject of an open report (issue #5026). 18.4 adds firmware for the RTL8761CU controller, but only the RTL8761B (0bda:a728) is named as fixed. Test it after updating. If it still fails, switch back with ha os boot-slot other.
Does this affect my Zigbee or Z-Wave devices?
Not directly. Radio protocols do not use public web certificates, and the Z-Wave JS app never contained the compromised root, according to the community test. The concern is only components that connect to the internet over HTTPS.
Sources: Home Assistant OS 18.4 release notes, Supervisor issue #7424 and its maintainer replies, Google, Mozilla and eMudhra statements. Status checked on October 28, 2026.