Ethereum client developers Teku and Besu have released security updates after a certificate flaw exposed some validator setups to attacks that could redirect their block rewards.
The vulnerability originated from compromised digital certificates linked to eMudhra, an Indian certificate authority that verifies websites and online services. Teku released version 26.10.3 on October 27 while Besu introduced version 26.10.2 on October 26.
Both updates address certificate weaknesses that could allow attackers to impersonate services used by Ethereum validators. However, developers confirmed that default Teku mainnet configurations were not affected and no exploitation had been reported.
The problem emerged on October 17, when researchers discovered that private keys belonging to eight eMudhra intermediate certificate authorities were unusually weak. The keys contained insufficient randomness, allowing researchers to recover them using information available in public certificates.
Consequently, attackers who recovered these keys could create fraudulent certificates that vulnerable applications might accept as genuine. Such certificates could allow attackers to impersonate trusted online services and intercept communications.
eMudhra revoked the affected certificates on October 18. In an October 26 statement, the company acknowledged the security failure, saying, “The flaw was ours.” It attributed the weakness to an error during certificate creation and said its investigation found no compromise of customer data.
Microsoft also took steps to block the certificates in Windows. However, the issue remained relevant to Ethereum because Java, which supports Teku and Besu, does not check certificate revocation by default.
According to Teku's security advisory, the vulnerability could affect validators that communicate with external services through HTTPS connections.
An attacker who intercepted communications between a validator and a remote beacon node could impersonate that service using a forged certificate. The attacker could then provide altered block information, causing the validator to propose a block that directs transaction fees to an attacker-controlled address.
Additionally, external signing services presented another possible attack route. These services manage validator signing keys separately from the main software. Teku warned that attackers impersonating an external signer could obtain signatures associated with validator exits or interfere with block-building operations.
However, the severity depended on the validator's configuration and security protections. Teku stated, “A default Teku node on mainnet is not affected and needs no action.” The developers also confirmed that Ethereum's normal peer-to-peer networking remained outside the identified vulnerability.
Teku released version 26.10.3, while Besu published version 26.10.2 to address the certificate issue. Both updates remove trust for four certificate roots from their Docker images, including emSign ECC Root CA G3, emSign Root CA G1, emSign Root CA G2 and AAA Certificate Services.
However, operators running standalone installations must update their Java environments separately. Installing the latest Ethereum client versions does not automatically remove compromised certificates from independently managed Java systems.
Teku also warned that Java 26 had reached the end of its support period and would not receive the necessary security update. Consequently, affected operators must migrate to Java 25 and review their certificate settings.
The advisory further identified certain testnet configurations as potentially exposed when downloading their initial blockchain state through HTTPS. These included setups involving Sepolia, Hoodi and Ephemery, depending on their configuration.
ALSO READ: Crypto Prices Today: Bitcoin Slips Near USD 80,361 as Fed Hold Keeps Hike Fears Alive