ObjectDeliverer v1.9.1 Released: Security Response to the eMudhra CA Compromise

We have released v1.9.1 of ObjectDeliverer, the communication plugin for Unreal Engine.

This release focuses on security.

About the October 2026 eMudhra intermediate CA key compromise

Between October 17 and 20, 2026, it was revealed that the private keys of eight intermediate CA certificates operated by eMudhra, an Indian certificate authority, could be recovered by third parties due to weak random number generation. An attacker holding these keys could forge TLS certificates for any domain, enabling impersonation of websites and services against browsers and other TLS clients.

Chrome, Microsoft, Apple, and Mozilla blocked the affected CAs immediately, and CA bundles such as curl and various Linux distributions were updated. However, TLS clients outside the browser ecosystem — including Unreal Engine applications — are not necessarily protected by OS or engine trust store updates alone.

References:

• eMudhra Intermediate CA Compromise (incident summary)
• Google Chrome Security announcement
• Cloudflare technical write-up

Main changes in v1.9.1

Rejection of certificates from the compromised eMudhra CAs

ObjectDeliverer’s TLS communication (both client and server) now includes a built-in distrusted-CA list.

• Certificate chains issued by the eight compromised intermediate CAs and their three signing roots are rejected
• They are rejected even if your OS or engine trust store still trusts them
• The policy is enforced not only for client-side server-certificate verification but also for mutual TLS (client-certificate verification)
• If the certificate chain cannot be inspected at all, the connection is rejected (fail-closed)

New Get Last Tls Error node

A new Blueprint API returns the reason of the most recent TLS connection failure, including rejections caused by the distrusted-CA list.

C++ API to register additional distrusted CAs

For future incidents of the same kind, a C++ API (FObjectDelivererTlsTrustPolicy) allows applications to immediately add extra certificate authorities to the rejection list at runtime.

Updated bundled CA certificates

The CA bundle shipped with the test project has been updated to the current Mozilla root store.

Supported versions

This fix has been applied to all supported branches: UE 5.5 through UE 5.8. While normally only the latest three engine versions receive updates, this security fix was additionally backported to UE 5.5.

Please update

If you use TLS communication, we recommend updating to v1.9.1 or later as soon as possible. The protection is active regardless of your trust store state, including self-signed certificates and private CAs.

Note that when Peer Verification Disabled is used, certificate verification itself is skipped and this protection does not apply. That setting leaves the connection vulnerable to man-in-the-middle attacks and should not be used in production.