Cloud Worker (Debian 12 bookworm) 2026-10-28

Security update for the eMudhra CA compromise

Cloud Worker (Debian 12 bookworm) 2026-10-28 is now available in Control Room. It is a security release for the eMudhra intermediate CA compromise disclosed on 20 October 2026. Every part of the image that checks TLS certificates now rejects the compromised certificates:

• Operating system certificate store. The Debian ca-certificates update removes the affected roots, emSign ECC Root CA - G3 and Comodo AAA Certificate Services. Tools that use the system store, such as curl, OpenSSL, Java and Python with truststore, reject the compromised chains.
• Workforce Agent Core v8.1.1 and RCC v21.4.0. The agent's own connections, and the uv installer RCC uses to build environments, no longer trust the compromised certificates. See the Agent Core v8.1.1 and RCC v21.4.0 release notes.
• Chromium. The system Chromium uses its own certificate store, not the operating system's. The image configures it to distrust emSign ECC Root CA - G3, so automations that drive the system browser reject the compromised chains too.

The image also includes the latest Debian package updates.

Your automation code does not need changes. Packages in your robot's own environment, such as pip and certifi, come from your conda.yaml. If you pin old versions there, update them; see the Python packaging guidance.

Which steps receive the update

Cloud Worker (Debian 12 bookworm) auto-update now points to the 2026-10-28 image, replacing 2026-10-01. Steps using this option receive the new container on their next run.

Steps using a dated image keep that image. To update them, select Cloud Worker (Debian 12 bookworm) 2026-10-28 in the process step configuration. We recommend this for every step, because older images still trust the compromised certificates.

See Robocorp-Hosted Cloud Worker for details on dated and auto-update images.