Identity and PKI · Checked 4 November 2026, 21:07 UTC.
Ping Identity has released PingOne LDAP gateway client 4.5.1 and recommends upgrading as soon as possible. Its 4 November release notes say the update refreshes the Docker base image and dependencies to address eMudhra-related certificate trust issues, including CVE-2026-91403 and CVE-2026-114820.
The notice gives no complete affected-version range. Inventory your gateway deployment.
Why a directory connector needs this attention
An LDAP gateway lets PingOne work with identities in an external directory, including authentication and some provisioning workflows. It can sit on a critical sign-in path even though employees never interact with its interface.
The underlying Java trust changes predate this release. Oracle's 21 October advisory covers distrust of affected intermediate CA certificates. Its 24 October advisory covers removal of affected root CA certificates. Today's development is the updated PingOne gateway package.
Separate the package from the runtime
Ping supports Docker, standalone Java and Windows deployments. Its current prerequisites specify Java 21 LTS or Java 25 LTS for standalone Java and Windows applications. For those deployments, include the installed Java build in your review: recording only the gateway version leaves the separately managed runtime unchecked.
Use the matching upgrade procedure. Docker and standalone clients can overlap during verification; the Windows-service steps instead unregister the old service and register its replacement. Plan the transition for your deployment.
A short rollout checklist
These are proposed operational checks, not results from our own installation test. We reviewed the public documentation.
- Find every instance. Record its host, deployment type, gateway version and runtime or container image. Include standby instances that could later receive traffic.
- Prepare recovery. Securely back up configuration and required logs. Keep credentials out of change tickets.
- Verify the replacement. Check the version and connection in PingOne, then test a directory-backed sign-in and any provisioning workflow you use.
- Investigate certificate failures. If the update exposes a trust problem, inspect the certificate chain and use the supported remediation route. Do not bypass TLS verification to make the test pass.
- Close the inventory. Review remaining old clients with the service owner; one upgraded instance does not establish complete coverage.
The useful completion record is the deployed version, the runtime or image, and the workflows checked. That gives the next operator more confidence than a closed patch ticket alone.