v26.4.8

v26.4.8

Polis FIPS image no longer trusts the roots of the compromised eMudhra CAs

Eight eMudhra intermediate certificate authority keys are compromised. The Polis FIPS image now distrusts the two root certificates those intermediates chain to, AAA Certificate Services and emSign ECC Root CA - G3, so Polis rejects certificates issued through them on every outgoing TLS connection.

If an identity provider, metadata URL, webhook endpoint, or database that Polis connects to presents a certificate that only chains to one of these roots, the connection now fails. Ask its operator to replace the certificate. Upgrade to this image and roll out new pods to apply the change.

The FIPS image now trusts the Red Hat system trust store instead of the root list built into Node.js. To trust a private certificate authority, add it with update-ca-trust in an image built on this one, or keep using NODE_EXTRA_CA_CERTS. If you set NODE_OPTIONS yourself, include --use-openssl-ca, or Polis falls back to the built-in list.