Security bulletins

The following describes all security bulletins related to Confidential Space.

To get the latest security bulletins delivered to you, do one of the following:

  • Add the URL of this page to your feed reader.
  • Add the feed URL directly to your feed reader: https://docs.cloud.google.com/feeds/confidential-space-security-bulletins.xml

GCP-2026-071

Published: 2026-10-28

Description

Description Severity Notes

Google has been notified of compromised private keys associated with third-party eMudhra (emSign) subordinate Certificate Authority (CA) certificates. These certificates are present in operating system certificate stores, including Container-Optimized OS (COS), which is used by Confidential Space.

For full details of the vulnerability, see the original security bulletin.

What should I do?

We recommend updating to the latest Confidential Space image (261001) immediately. This image removes the compromised CA certificates from the OS trust store.

Google Cloud changes how it treats images older than version 261001 after the following dates:

  • November 9, 2026:

    • Google Cloud Attestation stops sending attestation tokens to Confidential Space images older than version 260701.
    • Intel Trust Authority stops sending attestation tokens to Confidential Space images older than version 261001.
  • January 11, 2027: The STABLE support attribute is removed from Confidential Space image versions 260701–261000.

You can run the following gcloud CLI command to identify which Confidential Space image you are running across your VM instances: 

gcloud compute disks list \
    --filter="sourceImage ~ 'confidential-space'" \
    --format="table(name, users[0], sourceImage)"

How to update workloads

How to update relying parties

We recommend adding the following access policy to check for newer versions of the Confidential Space image: 

int(assertion.swversion[0]) >= 260701
 		Medium