Security Advisory: Linux kernel and Brotli vulnerabilities, and eMudhra certificate compromise (November 2026)
| Date | Change |
|---|---|
| 2026-11-06 | Initial publication. |
Key points for customers
- NetApp Instaclustr is responding to four recently disclosed software vulnerabilities and one certificate compromise that affect nodes on the Instaclustr Managed Platform: three vulnerabilities in the Linux kernel, one in the Brotli compression library, and an eMudhra certificate compromise affecting certificate trust stores on managed nodes.
- We will fix all five issues by upgrading the operating system including all affected packages on every managed node. We will contact you through a support ticket regarding the details of the upgrade for your account, as with any regular quarterly operating system upgrade. The upgrade restarts each node, one at a time.
- Until your clusters are upgraded, it is important to please review your cluster firewall rules so only the networks that need access can connect to further reduce any exposure.
Issue details
Through NetApp’s ongoing CVE monitoring process, NetApp has identified four software vulnerabilities and one certificate compromise affecting Instaclustr managed nodes.
Linux kernel
- CVE-2026-98432 is a flaw in how the kernel handles incoming TCP connections over IPv4. An attacker who can connect to a node does not need credentials to exploit it, and could read kernel memory, corrupt it, or crash the node. Your cluster firewall rules limit who can connect to your nodes reducing the attack surface to addresses you already trust.
- CVE-2026-98374 is a flaw in TCP Fast Open, a feature that lets a client send data in the first packet of a connection. An attacker must already be able to run a program on the node, then send crafted network traffic to it which is not possible either for customers themselves or a would-be attacker on Instaclustr managed nodes.
- CVE-2026-98260 is a flaw in the timers the kernel uses to measure how much processor time a program has used. As with CVE-2026-98374 an attacker must already be able to run a program on the node which would could be used to gain full administrator (root) access or crash the node.
Brotli
CVE-2026-111497 is a crafted compressed stream can overflow a buffer in the Brotli decoder. Researchers have called this Node2Shell and Broccoli2Shell. The affected managed applications are ClickHouse®, OpenSearch® Dashboards and Legacy Kibana clusters, where an attacker can get Brotli data to the decoder. Our assessment found no path to reach it in the other managed applications.
eMudhra certificate authorities
The private keys of eight eMudhra intermediate certificate authorities can be recovered from their public certificates. Anyone with those keys can issue a TLS certificate for any domain, and software that trusts the emSign ECC Root CA – G3 or Comodo AAA Certificate Services roots will accept it. NetApp Instaclustr does not use eMudhra certificates. The certificates your applications see when they connect to your clusters are not affected. The exposure is in outbound connections from managed nodes, and an attacker would need control of the network path or DNS to use it forming what is a man-in-the-middle style attack. The CVE identifier for this issue is CVE-2026-22063.
CVEs
| CVE | Public name | Area affected | Public CVSS v3.1 score | NetApp assessed score in the Instaclustr environment |
|---|---|---|---|---|
| CVE-2026-98432 | None | How the Linux kernel handles IPv4 TCP connections | 9.8 (Critical) | 7.7 (High) |
| CVE-2026-98374 | None | TCP Fast Open, which lets a client send data in the first packet of a connection | 8.8 (High) | 7.5 (High) |
| CVE-2026-98260 | None | Timers that measure the CPU time a process uses | 7.8 (High) | 7.5 (High) |
| CVE-2026-111497 | Node2Shell, Broccoli2Shell | The Brotli library that decompresses data | 8.1 (High) | 7.5 to 7.7 (High – affected technologies only) |
| NTAP-20261027-0001 (CVE-2026-22063) | eMudhra intermediate CA compromise | Trust in certificates issued by eight eMudhra intermediate CAs | 5.4 (Medium), NVD, scored for Mozilla products | 7.1 (High) |
Impact analysis
NetApp performed an investigation into these vulnerabilities and their potential impact on Instaclustr Managed Platform customers, Enterprise Support customers, and NetApp Instaclustr’s own systems.
Managed service customers
All managed nodes are affected. The system upgrade addresses all five issues. We will contact account owners through Zendesk to schedule it, following our standard upgrade process.
Once the upgrade is released, any new clusters will include it by default.
If services our nodes connect to on your behalf, such as your identity provider or metrics destination, present certificates that chain to the two eMudhra roots, those connections will fail after the upgrade. Check them before your upgrade is scheduled.
NetApp Instaclustr internal systems
Certificates that NetApp Instaclustr issues for clusters, the Console, and APIs are not affected.
Enterprise Support customers
- Install your vendor’s fixed kernel and restart. On Debian 12, the fixed package is linux 6.1.1901
- Update libbrotli1 (Debian 12: 1.0.9-2+deb12u1). Software that bundles its own copy of Brotli, including ClickHouse, needs its own update.
- Remove the two eMudhra roots from every trust store: the OS ca-certificates package (Debian 12: 20250419~deb12u2), Java cacerts, Python certifi (2026.10.19 or later), and container images. Removing Comodo AAA Certificate Services can break connections to servers that still chain only through that root, so test first.
- Restart processes after updating. Running processes keep the libraries and trust store they loaded at start.
For the most up-to-date information on which package version contains the fix, check your Linux vendor’s security advisory (Debian, Ubuntu, Red Hat, and others).
If you have further questions about these vulnerabilities, mitigations, or patching, contact NetApp Instaclustr Support. Existing customers can also raise a support ticket through the support portal.
