Ethereum client teams Teku and Besu have issued security patches following a certificate vulnerability that left certain validator configurations vulnerable to attacks capable of diverting block rewards.
The security flaw stemmed from compromised digital certificates tied to eMudhra, an Indian certificate authority responsible for authenticating websites and digital services. Teku rolled out version 26.10.3 on October 27, while Besu launched version 26.10.2 on October 26.
Both patches resolve certificate vulnerabilities that could have permitted malicious actors to pose as services utilized by Ethereum validators. Nevertheless, developers verified that default Teku mainnet settings remained secure and that no incidents of exploitation had been documented.
Ethereum Security Flaw Traces Back to eMudhra
The issue surfaced on October 17, when security researchers identified that private keys associated with eight eMudhra intermediate certificate authorities lacked adequate strength. These keys suffered from a lack of sufficient randomness, enabling researchers to reconstruct them utilizing data accessible in public certificates.
As a result, bad actors who successfully recovered these keys could generate fraudulent certificates that susceptible software might incorrectly validate as authentic. Such forged documents could enable attackers to masquerade as trusted digital services and eavesdrop on network traffic.
eMudhra revoked the compromised certificates on October 18. In an October 26 statement, the firm took responsibility for the security lapse, stating, “The flaw was ours.” The company blamed the weakness on a mistake made during the certificate generation process and noted that its internal review uncovered no breach of customer information.
Microsoft likewise took measures to disable the certificates within Windows. Even so, the problem persisted for the Ethereum ecosystem because Java—the underlying language for Teku and Besu—does not verify certificate revocations out of the box.
How Attackers Could Redirect Ethereum Validator Rewards
As outlined in Teku’s security advisory, the weakness had the potential to impact validators that interact with external tools via HTTPS sessions.
An adversary positioned to intercept traffic between a validator and a remote beacon node could spoof that endpoint using a counterfeit certificate. The attacker could subsequently supply manipulated block data, tricking the validator into submitting a block that routes transaction fees to an address under the attacker’s control.
Furthermore, remote signing tools presented an alternative vector for attack. These applications handle validator signing keys independently from the primary node software. Teku cautioned that bad actors posing as an external signer could capture signatures tied to validator exits or disrupt block construction workflows.
Still, the degree of risk relied heavily on how individual validators were configured and secured. Teku noted, “A default Teku node on mainnet is not affected and needs no action.” The project leads also verified that standard Ethereum peer-to-peer networking operations were unaffected by the flaw.
Teku and Besu Release Fixes for Vulnerable Ethereum Nodes
Teku introduced version 26.10.3 and Besu published version 26.10.2 to tackle the certificate problem. Both updates strip trust for four certificate roots from their respective Docker containers, covering emSign ECC Root CA G3, emSign Root CA G1, emSign Root CA G2, and AAA Certificate Services.
On the other hand, operators running standalone deployments must upgrade their Java environments independently. Simply installing the newest Ethereum client releases will not purge the compromised certificates from separately administered Java installations.
Teku additionally cautioned that Java 26 has reached the conclusion of its lifecycle and will not receive the essential security patch. Consequently, impacted operators are required to transition to Java 25 and inspect their certificate parameters.
The bulletin additionally pointed out that specific testnet setups could be at risk when pulling their initial blockchain state through HTTPS. Affected environments included Sepolia, Hoodi, and Ephemery deployments, contingent upon their specific setup.
ALSO READ: Crypto Prices Today: Bitcoin Slips Near USD 80,361 as Fed Hold Keeps Hike Fears Alive
