Sandbox containers before 0.12.14 trust compromised eMudhra intermediate CA certificates

Symptom

HTTPS from the sandbox to test hosts at emudhra.we-have-a-problem.com succeeds instead of failingRunning sandboxes keep the old image after a Worker redeploy

Cause

Sandbox images before 0.12.14 trust eight eMudhra intermediate CAs whose private keys can be recovered, so forged certificates are accepted for direct HTTPS from the container (mountBucket, backups, gitCheckout, tunnels, user code). Running sandboxes and old snapshots keep the old image.

Fix

Upgrade @cloudflare/sandbox to 0.12.14 and update the Dockerfile FROM line, keeping any -python, -opencode or -musl suffix. For 1.x, docker pull base images, run docker builder prune --all, redeploy, destroy running sandboxes, and recreate snapshots from the new image.

ApplyCopy

FROM docker.io/cloudflare/sandbox:0.12.14

Affected

Sandbox SDK images before 0.12.14 (0.13 prerelease before 0.13.0-next.825.1; 1.x images built on stale base images), as of 2026-10-22

Sources

• https://developers.cloudflare.com/changelog/

Last verified 2026-10-24 · Confirmed by 0 builders