CoinDesk
Teku and Besu released updates after researchers found that weak cryptography exposed the private keys for eight intermediate certificate authorities operated by Indian issuer eMudhra. The flaw could have let attackers impersonate services used by some Ethereum validators and redirect block rewards. No exploitation has been reported, and default Teku mainnet nodes were not affected.
Why it matters
Validators rely on digital certificates to verify that they are connecting to the right services. With the exposed keys, an attacker positioned between a validator and a service could present a forged certificate that unpatched software accepted as genuine. Teku warned that a compromised connection could lead a validator to propose a block directing fees to an attacker. A fake external signer could also provide signatures used to change where rewards go, a setup Teku ranked as the riskiest.
Teku 26.10.3 and Besu 26.10.2 remove trust in certificates linked to eMudhra from their Docker images. Browsers had blocked the certificates, and eMudhra revoked them a day after researchers identified the issue on Oct. 17. The company has said it will exit the certificate business.
Market impact
The immediate concern is operator security, not a reported Ethereum network-wide compromise. Teku said default mainnet nodes are unaffected and need no action, but other configurations may require updates. Docker users should install the latest Teku or Besu images. Operators running the software directly must update Java separately, because updating the Ethereum client does not change Java’s trusted certificates; Docker updates do not patch Java installed on the host either.
Operators still using Java 26 face an additional step: Teku says that version is end of life and will not receive a patched build, so they need to move to Java 25. The incident highlights how certificate trust and host software can become part of validator security alongside Ethereum client updates.
Frequently asked questions
-
How could the certificate flaw have put Ethereum validator rewards at risk?
An attacker could impersonate a service used by a validator, potentially causing it to propose a block that directs fees to the attacker. A fake external signer could also provide signatures used to change reward destinations.
-
Were default Teku mainnet nodes affected?
No. Teku said default mainnet nodes were not affected and did not need action. The issue applied to some other validator configurations.
-
What did the Teku and Besu updates change?
Teku 26.10.3 and Besu 26.10.2 remove trust in certificates linked to eMudhra from their Docker images.
-
Why might updating Teku or Besu not be enough for some operators?
Operators running the clients directly must update Java separately because a client update does not change Java’s trusted certificates. Docker updates also do not patch Java installed on the host.
-
What should operators still using Java 26 do?
Teku says Java 26 is end of life and will not receive a patched build. Operators still using it need to move to Java 25.
WuBlockchain
Crypto News
CoinTelegraph
Glassnode
TheBlock