Updates for Teku and Besu have been released to address a certificate vulnerability that could have caused fees from blocks in some Ethereum validator setups to be redirected to attackers.
According to CoinDesk, the issue stemmed from a security vulnerability involving eMudhra, a digital certificate authority based in India. The ready-to-use Docker packages in Teku version 26.10.3 and Besu version 26.10.2 removed trust in certificates associated with the authority.
The Teku team said that mainnet nodes running with default settings were not affected and did not need to take any action. It also said there had been no reports of the vulnerability being exploited.
How could a fake certificate have led to a loss of funds?
Researchers found on October 17 that the private keys for eight intermediate certificate authorities belonging to eMudhra had been generated without sufficient randomness. This weakness made it possible to calculate the keys—which should have remained secret—from publicly available certificates.
An attacker who obtained such a key could create fake certificates that outdated software would accept as legitimate. Browsers blocked the certificates, and eMudhra revoked them a day later. However, because the Java environment in which Teku and Besu run did not check for certificate revocation by default, some setups continued to trust those certificates.
Ethereum validators are systems that stake ETH to secure the network and take on the task of proposing blocks. An attacker who intercepted and interfered with a validator’s communications with another service over the internet could use a fake certificate to impersonate that service. According to Teku’s warning, a deceived validator could propose a block that sent block fees to the attacker’s address.
The team identified impersonation of an external signer that stores validator keys in a separate service as the riskiest scenario. The initial warning came from Teku’s security partner, Consensys Diligence.
Docker update does not cover every setup
The patches fix certificate trust in Teku and Besu’s Docker images. Operators who run the software directly on their machines without Docker also need to update their Java environment separately. The new Docker image does not change the trusted certificate list for Java installed on the host machine.
According to Teku’s announcement, Java 26 has reached end of support, so no patched build will be released for that version; operators using it need to switch to Java 25. Therefore, the fix to apply depends on how the validator was set up.
Not investment advice.