Mendix Technology B.V. Status
Real-time updates of Mendix Technology B.V. issues and outages
Mendix Technology B.V. status is Operational
Mendix Cloud US-East
Mendix Cloud EU (Frankfurt)
Mendix Cloud Asia Pacific (Tokyo)
Mendix Cloud Free Tier EU
Mendix Cloud UK
Mendix Cloud IE
Mendix Cloud US-West
Lior Grossman
Maker of StatusSight
I built StatusSight. Here's what I'm building next with AI.
In Lior Builds, my free newsletter, I share one story from a product I built with AI, plus short notes on the tools and models worth using: what worked, what did not, and the numbers behind it. Every week or two.
Active Incidents
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Recently Resolved Incidents
No recent incidents
Mendix Technology B.V. Outage Survival Guide
You're checking on Mendix Technology B.V. - but is your own site converting?
Outages aren't the only thing that costs you visitors.
Get a visual audit that shows exactly where your site loses conversions.
Free, takes 2 minutes.
Mendix Technology B.V. Components
Mendix Technology B.V. Mendix Services
Project Management
Project Management
Project Management
Control Center
Control Center
Identity and Access Management
Team Server
Studio Pro
Marketplace
Community
Marketplace
Community
BYOIDP Wizard
Support Portal
Academy
Catalog
Documentation
Support Portal
Native Mobile Builder
APIs
Licensing Service
Software Composition
Self-service
Deploy - Mendix Cloud
Model Server
Logs and Metrics - Mendix Cloud
Pipeline Portal
Webhooks
Mendix Cloud: GenAI Resource Packs Portal
Workstation Management
Approval Requests
Mendix Technology B.V. Mendix Cloud Regions
Mendix Cloud US-East
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud EU (Frankfurt)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Tokyo)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Free Tier EU
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud UK
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud IE
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud US-West
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Sydney)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Canada (Central)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Singapore)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Mumbai)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Middle East (Bahrain)
Mendix Cloud Africa (Cape Town)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud South America (São Paulo)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud EU (Frankfurt 2)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Middle East (UAE)
Mendix Cloud Asia Pacific (Osaka)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Seoul)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Asia Pacific (Jakarta)
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud EU (Frankfurt): GenAI Resources
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Canada (Central): GenAI Resources
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Technology B.V. Mendix Cloud Dedicated Regions
Mendix Cloud Dedicated US-West Echo
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated UK Echo
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated Asia Pacific (Singapore) Echo
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated EU (Frankfurt) Alfa
Mendix Cloud Dedicated US-East Hotel
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated US-West Alfa
Mendix Cloud Dedicated US-East Mike
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated US-East Papa
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated EU (Frankfurt) Sierra
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated EU (Frankfurt) Uniform
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated Asia Pacific (Singapore) Able
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Mendix Cloud Dedicated US-East Kilo
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
STS Service
Mendix Cloud Dedicated US-East Charlie
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Cognitive AI Service
Mendix Cloud Dedicated US-East Colin
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.
Invoice Processing
Mendix Cloud Dedicated EU (Frankfurt) Metro
What happened
A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.
Who is affected
Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.
What we did
We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included.
What you need to do
The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough.
If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:
- Test environment
- Acceptance environment
- Production environment
If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.
A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you.
What to expect after redeploying
If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.
If you have any questions, feel free to contact support.