Security Update for Lime BI - Compromised eMudhra Certificate Authority

The Java runtime that Lime BI runs on trusted a certificate authority whose private keys were stolen. An attacker with those keys and access to the network could impersonate a server that Lime BI connects to.

• Severity: Low
• Status: Patch available
• Evidence of exploitation: None observed
• Environment: On-premise and Cloud

• Lime BI on-premise installations made with Lime BI 4.1.0 to 4.17.x. These versions install Java 21.0.9, which trusts the certificate authority.
• Lime BI in Lime Cloud. All cloud environments are already updated.

Installations made with Lime BI 4.0.x or earlier are not affected, because they run Java 11, which does not trust this certificate authority. Lime CRM itself is not affected.

To exploit this, an attacker must intercept the traffic between Metabase and a service it connects to, and also hold a certificate forged with the stolen keys. The affected connections are outgoing ones from Metabase: email (SMTP), webhooks, and Metabase's license check. LDAP is also affected, but only if you set it up in Metabase yourself.

NB! Signing in to Lime BI from Lime CRM is not affected, and neither is Metabase's connection to the Lime CRM database.

In Lime Cloud, traffic inside the platform stays on networks that Lime controls. Only email, webhooks, and the license check leave the platform, and intercepting them takes an attacker who controls part of the internet route, such as an internet provider.

In October 2026, the private keys of intermediate certificate authorities under eMudhra's emSign ECC Root CA - G3 were compromised. This is tracked as CVE-2026-111943. The Java trust store updates that remove the root are tracked as CVE-2026-91403 and CVE-2026-114820. There is no evidence that this has been exploited against Lime BI.

Lime BI 4.18.0 and later install Java 21.0.13, which no longer trusts emSign ECC Root CA - G3.

Lime Cloud is already updated. You don't need to do anything.

1. On the server where Lime BI runs, open the Lime BI installation folder. The default is C:\LimeBI.
2. Find the folder whose name starts with jdk-:
   • jdk-21.0.9+10: your installation is affected. Upgrade Lime BI.
   • jdk-21.0.13+9: your installation already has the fix.
   • jdk-11.0.9.1+1: your installation is not affected by this issue.

• A backup of the Lime BI Postgres database.
• The Postgres connection details and the password of the service account. lime-bi install asks for them.

1. In the solution, run poetry update lime-bi to get the latest Lime BI (4.18.0 or later), and make a release. Do not install it on the server yet.
2. On the server, open a command prompt as administrator and run lime-bi uninstall. It removes the service and the installation folder. Dashboards, questions, and settings are in the Postgres database and stay as they are.
3. Install the updated solution.
4. Run lime-bi install, and enter the same installation folder, service account, and Postgres details as before.
5. Check that the installation folder now has a folder named jdk-21.0.13+9.

If lime-bi install fails with “Failed to unzip jdk”, the solution still has a Lime BI version before 4.18.0. Repeat step 1.

You can remove the certificate from the Java runtime you have now. The commands use the default installation folder, so change the path if yours is different.

1. Open a command prompt as administrator.
2. Remove the certificate:

   "C:\LimeBI\jdk-21.0.9+10\bin\keytool.exe" -delete -alias "cn_emsign_ecc_root_ca__g3,o_emudhra_technologies_limited,ou_emsign_pki,c_in [jdk]" -cacerts -storepass changeit

3. Restart the Lime BI service in Windows Services. Java reads the trust store only at startup.
4. Check that the certificate is gone. This command prints nothing:

   "C:\LimeBI\jdk-21.0.9+10\bin\keytool.exe" -list -cacerts -storepass changeit | findstr /i emsign_ecc_root_ca__g3

This is a temporary fix. Upgrade Lime BI when you can.

1. Check your Java version using the instructions above.
2. Upgrade to Lime BI 4.18.0 or later if your installation is affected.
3. Remove the certificate if you can't upgrade right away.
4. Contact Support if you need help.