Ethereum client developers Teku and Besu have shipped security updates addressing an Ethereum client certificate flaw that opened the door for attackers to pose as services validators depend on and potentially divert their block rewards. Teku published version 26.10.3 on October 27, while Besu shipped version 26.10.2 a day earlier, according to Crypto News.
Both updates strip trust for affected certificates from the Docker images many operators use to deploy and run Ethereum node software, Crypto News and KuCoin reported. Teku supports Ethereum's proof-of-stake operations while Besu processes transactions, and validators stake ETH to help secure the network in exchange for fees earned by proposing blocks.
Compromised eMudhra certificates at root of flaw
The Ethereum client certificate flaw traces back to weak cryptographic keys tied to eight intermediate certificate authorities operated by Indian digital certificate provider eMudhra, according to security advisories cited by Crypto News. Researchers identified the problem on October 17, finding that the private keys had been generated with insufficient randomness and could be mathematically recovered from information in the public certificates.
Whoever held those keys could mint certificates that appeared genuine to any application still trusting the affected authorities. Microsoft said in an October 26 security advisory that six of the certificates were used to secure internet connections, with the other two tied to code signing.
eMudhra revoked the affected intermediate certificates on October 18, and major browsers moved to block them. Microsoft cut off the affected certificate authorities with a Windows security update on October 20, then issued a second update on October 26 removing seven associated certificates from its trusted list, Crypto News reported. eMudhra has since said it will leave the certificate business, according to KuCoin.
Java settings kept Ethereum nodes exposed
The fixes remained necessary for Ethereum because Teku and Besu run on Java, whose certificate validation does not check revocation status by default. That meant affected Java installations could keep accepting certificates linked to the compromised authorities even after browsers and operating systems had cut them off.
The exposure applied to validators that rely on external services reached over HTTPS connections, including remote beacon nodes, external signing services, execution clients, block builders, relays and tools that supply validator configuration data, according to Teku's advisory. Ethereum's underlying peer-to-peer networking protocols were not affected because they do not rely on the compromised certificate authorities.
Consensys Diligence, Teku's security partner, first raised the issue, KuCoin reported.
How the Ethereum client certificate flaw could divert rewards
To exploit the Ethereum client certificate flaw, an attacker would need to intercept a connection between a validator and an external service and present a forged certificate the validator's software accepted as legitimate. In one scenario laid out in Teku's advisory, an attacker impersonating a remote beacon node could feed the validator manipulated information about the block it was preparing to propose.
According to Teku, a deceived validator could end up proposing a block whose transaction fees flow to an address the attacker controls. The advisory described the external signer scenario as the most serious: such services store validator signing keys apart from the primary node software, and an impersonator could potentially obtain signatures associated with validator exits depending on the configuration. Setups using mutual TLS authentication could limit the damage to a denial of service, Teku said.
Teku's developers said default mainnet configurations were not affected and require no action, and that there has been no reported exploitation of the vulnerability. Certain testnet configurations could be exposed, including setups that download their initial blockchain state over HTTPS, the advisory noted.
What node operators must do
Teku's version 26.10.3 removes four certificate roots from its Docker images: emSign ECC Root CA G3, emSign Root CA G1, emSign Root CA G2 and AAA Certificate Services. Besu applied the same removals in version 26.10.2, and operators running either client through Docker should install the latest images.
The updates do not touch Java installations maintained separately by node operators. Anyone who runs Teku or Besu from standalone binary distributions needs to inspect their installed Java runtime and refresh its trusted certificates where required, and the replacement Docker images likewise leave the host machine's Java installation unchanged.
Teku also warned that operators still on Java 26 need to migrate to Java 25, because Java 26 has reached end of life and will not receive the required patched build.
Latest in a string of validator security concerns
The patches arrive after a series of other recent security issues touching Ethereum validator infrastructure. Earlier this month, crypto.news reported that MetaMask had started pulling out affected validators in response to a separate infrastructure security incident disclosed on September 30.
Separately, a validator deposit flaw in the upcoming Glamsterdam upgrade was fixed by Ethereum developers after researchers identified a scenario in which builder accounts could receive ETH intended for validators. The upgrade has separately been delayed after developers postponed its Hoodi testnet activation on October 26 to investigate smart contract compatibility concerns involving EIP-8037, and no replacement activation date has been announced.
Conclusion
Teku and Besu have both shipped updates that remove trust for the compromised eMudhra certificates from their Docker images, closing the Ethereum client certificate flaw that could have let attackers redirect validator block rewards under certain configurations. No exploitation has been reported, and default mainnet setups are unaffected. The immediate step for operators is to install the latest Docker images or, for standalone installations, update their Java runtime's trusted certificates separately, with anyone still on Java 26 required to move to Java 25.
Frequently Asked Questions
What are Teku 26.10.3 and Besu 26.10.2?
They are security updates released by the Ethereum clients Teku and Besu on October 27 and October 26 respectively. Both versions remove trust for compromised eMudhra certificates from the Docker images operators use to run Ethereum nodes, addressing the Ethereum client certificate flaw that could let attackers redirect validator block rewards.
How could the eMudhra certificate flaw redirect ETH rewards?
An attacker intercepting a connection between a validator and an external service could present a forged certificate and impersonate that service. According to Teku, a deceived validator could propose a block directing transaction fees to an attacker-controlled address, and a spoofed external signer could supply signatures that change the reward destination.
Are default Ethereum mainnet nodes affected by the certificate vulnerability?
No. Teku's developers said a default mainnet setup is safe from the flaw and needs no action from its operator, and no exploitation has been reported. Exposure was limited to certain non-default configurations, such as testnet setups that fetch their initial blockchain state over HTTPS.
Do Teku and Besu operators need to update Java separately?
Yes, for standalone installations. The client updates and replacement Docker images do not modify Java's trusted-certificate list, so operators running Teku or Besu directly on a machine must update their Java runtime's trusted certificates themselves. Operators still on Java 26 must switch to Java 25, since Java 26 is end of life and will not get the patched build.
What caused the eMudhra certificate compromise?
Researchers found on October 17 that private keys for eight eMudhra intermediate certificate authorities had been generated with insufficient randomness, making them recoverable from the public certificates. eMudhra revoked the certificates on October 18, browsers blocked them, and eMudhra has since said it will leave the certificate business.