Ethereum clients patch certificate flaw affecting some validator reward routes

Traders Union
All News
Crypto
Ethereum client certificate flaw patch

Highlights

Teku and Besu released updates (Teku 26.10.3, Besu 26.10.2) to distrust eMudhra-linked certificates after researchers exposed weak cryptography on Oct. 17.
Vulnerability allowed attackers to forge certificates, potentially redirecting validator rewards, but Teku states default mainnet nodes are unaffected and reports no exploitation.
Operators must update Java separately on non-Docker setups, and Teku requires migration from unsupported Java 26 to Java 25, as Java 26 won't be patched.

Client updates and affected configurations

As reported by CoinDesk, Teku and Besu have released updates that stop trusting certificates linked to eMudhra after researchers found weak cryptography exposed private keys for eight of the Indian certificate issuer’s intermediate certificate authorities.

Teku released version 26.10.3 on Tuesday, while Besu released version 26.10.2 on Monday. In Docker images used by many operators, both updates remove trust in the affected certificates. Validators rely on digital certificates when connecting over the internet to external services, helping confirm those services are genuine.

Researchers found on Oct. 17 that the private keys behind the eight intermediate certificate authorities had been generated with too little randomness. Because certificates are public, that weakness meant the keys could be derived from the certificates themselves, allowing forged certificates to appear valid to unpatched software.

Operational risks and mitigation steps

An attacker positioned between a validator and a connected service could impersonate that service and potentially cause a validator to propose a block that pays fees to the attacker’s address. Teku says the riskiest setup involves a fake external signer, the separate service that holds validator keys, because it could provide signatures used to change where rewards go.

Teku says a default mainnet node is not affected and requires no action, and the team adds that no exploitation has been reported. Consensys Diligence, Teku’s security partner, initially flagged the issue, while browsers blocked the affected certificates and eMudhra revoked them a day later.

Operators running Teku or Besu directly on their own machines must update Java separately, because updating the Ethereum software does not change Java’s trust store. The new Docker images also do not fix Java installed on the host system, and operators still using unsupported Java 26 need to move to Java 25 because Teku says Java 26 will not receive a patched build.

Our earlier article on the surge in cybersecurity investment highlighted that funding strengthened even as overall deal counts fell, with capital concentrating into fewer, larger late-stage rounds. We noted that identity security and AI-driven security companies attracted much of the money, alongside continued consolidation through major acquisitions—signaling sustained focus on protecting critical trust and authentication systems.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.