Trust Center

We have removed the affected eMudhra certificates from the trust stores across the Tines cloud platform. Self-hosted version 44.0.2 is now available with the updated trust stores. Self-hosted customers should upgrade to 44.0.2.

We are aware of the recently disclosed industry-wide issue involving eight compromised intermediate TLS certificates issued by the certificate authority eMudhra.

Like other technology providers, we are removing these certificates from the trusted certificate stores used across the Tines platform and our container images. This work is in progress, and we will share updates here as it continues.

We are monitoring the situation closely. If you have any questions, please contact your Tines account team or our support team.

Tines is aware of CVE-2026-111497, a recently disclosed vulnerability in the decoder of the Brotli compression library. We have updated Brotli across Tines Stories Cloud and Tines 3B Cloud. Cloud customers do not need to take any action.

Updated releases are available for self-hosted customers to patch the vulnerability:

• Tines Stories Self-hosted: Upgrade to version 44.1.0 or later.
• Tines 3B Self-hosted: Upgrade to version 6.2.0 or later.

We will also release patches for the previous major version (43) of Tines Stories and will update this post when they are available. Customers on earlier versions should upgrade to a supported release to receive the fix.

If you are unable to upgrade, or have other questions, please contact your Tines account team or our support team.

We are aware of the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Tines is not affected, as PHP is not used anywhere in our environment, including our products.

If you have any questions, please contact your Tines account team or our support team.

Self-hosted version 44.0.2 is now available and includes the patched Ruby version (4.0.9). Self-hosted customers should upgrade to 44.0.2.

We are aware of the recently disclosed Ruby vulnerabilities (Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264) and have patched our cloud environments accordingly.

If you have any questions, please contact your Tines account team or our support team.

Tines is sharing an update with our customers regarding an incident involving Klue, a third-party software vendor that integrated with Tines' Salesforce environment. Tines was notified that it was among the organisations affected by this incident, which impacted Tines’ Salesforce instance and accessed the CRM data it holds.

We have found no evidence of unauthorized access to any other systems including the Tines platform and customer environments.

What happened
Tines was notified that a threat actor gained access to systems operated by Klue and used credentials associated with customer integrations to access Salesforce data across multiple organizations, including Tines. Salesforce has since suspended Klue's access, and we immediately initiated an investigation.

Our investigation found that Tines’ Salesforce environment was accessed as part of this incident. Information accessed included business and account contact information, opportunity information and commercial communications stored in Salesforce. This did not impact the Tines platform or customer environments.

What you should keep in mind
A risk arising from this incident is the potential use of this information in targeting phishing or social engineering attempts. We recommend that your team remains vigilant of unexpected communications referencing Tines.

For more information, our blog post details the up-to-date information on this incident and our response. It will be updated as and when we receive any new information.