Teku and Besu Patch Ethereum (ETH) Flaw Tied to 8 eMudhra CAs

Teku 26.10.3 and Besu 26.10.2

Teku's developers shipped version 26.10.3 of the client on Tuesday, and Besu followed at version 26.10.2 on Monday, with both updates pulling trust in certificates tied to India's eMudhra out of their Docker images. The changes are logged in the official release notes for Teku 26.10.3 and for Besu 26.10.2. They close a path that, in the riskiest operator setups, could have let an attacker quietly steer some validator rewards to an address of the attacker's choosing. No breach of consensus rules occurred, and the Teku team records that no exploitation has been reported so far.

Validators are the computers that commit stake to secure Ethereum's proof-of-stake chain, proposing blocks and collecting fees in return. Some of them talk to outside services over the internet and rely on digital certificates to confirm that the service at the other end is genuine. That plumbing, not the protocol itself, is where the exposure sat. The Ethereum (ETH) price never depended on the compromised certificates, but the fees and rewards validators earn do move through the affected tooling.

Researchers found on October 17 that the private keys behind eight of eMudhra's intermediate certificate authorities had been generated with too little randomness. Because certificates are public documents, the keys could be reconstructed from the certificates themselves, and anyone holding them could forge certificates that unpatched software would accept as genuine. Browsers moved first and stopped accepting them. eMudhra revoked the certificates the following day and has since said it will exit the certificate business altogether. The weakness was first flagged by Consensys Diligence, the security partner behind Teku's audits. Docker images, the prepackaged builds many operators deploy, are the affected distribution channel in both cases, and the wider Ethereum (ETH) client ecosystem runs its validator tooling on Java, a detail that shaped both the exposure and the fix.

Why Default Mainnet Nodes Are Safe

Java, the language both clients are written in, does not check whether a certificate has been revoked by default. Teku's Docker images therefore went on accepting the compromised certificates even after browsers had dropped them, which is why the fix ships inside the images rather than through a Java update alone. The advisory the Teku team published with the release sets out the attack in sequence. An attacker positioned between a validator and a service it connects to could impersonate that service, and a validator taken in by the impersonation could then propose a block that pays its fees to the attacker's address. The riskiest configuration involves the external signer, the separate service that holds a validator's keys: a forged one could hand over the signatures that change where rewards are sent.

That gap in Java's defaults explains the sequencing of the response. Browsers check revocation, so they cut the certificates off within a day. Ethereum (ETH) tooling built on Java did not, so the client teams rebuilt their Docker images with eMudhra removed from the trusted set rather than waiting on a runtime-level repair. For most operators the news is simpler: a Teku node running an untouched default configuration on mainnet is unaffected and needs no action, and the record so far points to no stolen rewards. Remediation splits by setup. Operators running prepackaged Docker images should pull the latest Teku or Besu builds. Those running the software directly on their machines face more work, because updating the Ethereum client does not touch the Java installation on the host, and the new images do not repair host-level Java either. The hardest case belongs to anyone still on Java 26. That version has reached end of life and will not receive a patched build, which leaves a move to Java 25 as the only way forward for those operators.

The episode reads as an operations story more than a protocol one. The consensus layer held, and the population with real exposure is narrow: operators with external signers, non-default network paths or aging Java installs. It is still a line item for anyone weighing the upkeep involved in running an Ethereum node, since the runtime around the client needs patching on its own schedule. Both patched versions are live in each project's repository, so the remediation path is available to every operator today. No independent assessment of the flaw's severity has surfaced since the two releases landed, so the client teams' advisories stand as the only public evaluation for now.