Hi Team ,
We are currently reviewing the release notes for SonarQube 2026.5.3 LTA and noticed that a security-related fix SSF-1696 has been included in this release. However, we were unable to find sufficient details in the associated Jira issue(s) or release documentation explaining the nature and scope of the security fix.
Background
Recently, the eMudhra Certificate Authority incident, involving the compromise of eight intermediate CA signing keys, was publicly disclosed. As part of our internal security and risk assessment process, we are evaluating whether any security-related updates in products within our environment are connected to this incident.
Could you please confirm:
Whether the security fix included in SonarQube 2026.5.3 LTA is related to the eMudhra Certificate Authority compromised intermediate keys incident ?
If the fix is related, we would appreciate clarification on:
- The scope and impact of the issue.
- Whether any SonarQube versions are specifically affected,Whether the issue affects only certain operating systems, Java runtimes
- Any actions required from our side, such as certificate updates or additional configuration changes.
- Any available advisory, knowledge base article, or security documentation that can be referenced for internal compliance and risk assessment purposes.
This information will help us complete our security review and upgrade planning.
Notes: Currently we are using Sonarqube version 2026.2 (121184) Latest version due to Java 25 changes which we upgraded from 2025.*LTA .
Thank you for your assistance.
