# Security advisory: SonarQube Community Build guidance for eMudhra

Canonical: https://brew.new/templates/sonarsource/security-advisory-sonarqube-community-build-guidance-for-emudhra

Brand: sonarsource.com
Category: security-alert

![Preview of Security advisory: SonarQube Community Build guidance for eMudhra](https://cdn.brew.new/email-preview-852f5b9ac26a3840-tracking_r57pws93qx99a43f7mkencgszs8gv7zm-1792801291543.png)

## Email content

Sonar

Dear SonarQube Community Build user,

We are writing to inform you about a security incident involving compromised certificate-signing keys operated by eMudhra under its emSign brand. Please use the provided workaround below for SonarQube Community Build and any companion components you use to address the exposure.

The exposure involves certificate trust used for outbound connections; this is an industry-wide issue and is not a vulnerability in SonarQube Community Build’s own code. An attacker already positioned on the network path could use a forged certificate to read or alter data exchanged with connected services. This requires network position and continued trust in the affected certificates.

Action required

SonarQube Community Build: Apply the workaround for your installation type via the instructions in the Sonar documentation.

SonarQube CLI: If in use, update to version 1.10.1.16776 or later using the CLI update instructions

Bitbucket: If you use the Bitbucket sonarqube-quality-gate pipe, update its version in your pipeline configuration to 1.2.2. The image is available on Docker Hub.

SonarQube MCP Server:

If in use, update it to the version 1.30.0or above.

SonarQube for IDE: Update to the latest version of the IDE plugin:

Visual Studio Code: 6.2.0 or above

Visual Studio: 11.2.0 or above

JetBrains IDE: 13.1.0 or above

Eclipse: 13.2.0 or above

We have no evidence of exploitation, and we have received no reports of any issues related to this incident. The workaround is a proactive measure to protect your workflows.

Thank you for your prompt attention to this matter. We recognize that applying these updates requires time from your team. If you have any questions, please refer to the official Sonar Community post.

The Sonar Team

Trusted by users everywhere

G2 Spring 2026 - Leader Enterprise

G2 Spring 2026 - Leader

G2 Spring 2026 - Momentum Leader

Gartner Peer Insights Customer Choice 2025

Not rendering correctly? View in browser

This email was sent by: SonarSource Sàrl

P.O. Box 765, Geneva, GE, CH-1215 Switzerland

You are receiving this email because you previously engaged with SonarSource.

Don't want to receive emails from us? Unsubscribe

Update Profile

Manage Subscriptions

Privacy Policy

YouTube

X

LinkedIn

[Open and remix this design](https://brew.new/templates/sonarsource/security-advisory-sonarqube-community-build-guidance-for-emudhra)

[Browse email designs](https://brew.new/browse/templates)