Ethereum Client Developers Released Security Updates for Teku and Besu

Developers of Ethereum clients Teku and Besu have released security updates: Besu version 26.10.2 on October 26, and Teku version 26.10.3 on October 27. These updates address a vulnerability that could allow attackers to impersonate validator services and redirect block rewards.

The issue arose due to weak keys from eight intermediate certification authorities of India's eMudhra: private keys were generated with insufficient randomness and could be mathematically reconstructed from public certificates. eMudhra revoked the certificates on October 18, and Microsoft blocked them with Windows updates on October 20 and 26.

For Ethereum, the problem remains relevant: Teku and Besu use Java, which by default does not check the revocation status of certificates. Therefore, affected installations could accept certificates from compromised authorities even after revocation.

The updates remove trust in four eMudhra root certificates from Docker images. Operators of standalone Teku or Besu installations need to separately update their Java environments. Teku warned that Java 26 has reached the end of its lifecycle, necessitating a transition to Java 25.

The vulnerability could affect validators using external services for signing, communication with beacon nodes, or obtaining block assembly data. An attacker would need to intercept the connection and present a fake certificate. Teku highlighted the scenario with an external signing service as particularly serious: depending on the configuration, this could provide signatures for validator exit; mutual TLS authentication limited the consequences to denial of service. Ethereum's peer-to-peer protocols are not affected. Standard mainnet configurations were not vulnerable, and no exploitation cases have been recorded.