Ethereum clients patch flaw that could redirect ETH rewards

Oct 29, 2026

Ethereum client developers Teku and Besu have released security updates to address a certificate vulnerability that could allow attackers to impersonate services used by validators and potentially redirect their block rewards.

According to security advisories accompanying the releases, the issue originated from compromised certificate authority keys belonging to Indian digital certificate provider eMudhra, which left certain Ethereum node configurations exposed to forged HTTPS connections.

Ethereum security flaw traced to compromised eMudhra certificates

The security issue began with a cryptographic error involving eight intermediate certificate authorities operated by eMudhra, whose private keys were found to have been generated using insufficient randomness.

Researchers identified the problem on October 17, discovering that the private keys could be mathematically recovered from information available in the public certificates.

How attackers could redirect Ethereum validator rewards

Teku’s security advisory identified several possible attack scenarios involving validators that communicate with external services through HTTPS connections.

One scenario involves an attacker impersonating a remote beacon node used by a validator to coordinate its duties on Ethereum.

If the attacker successfully intercepted the connection and presented a forged certificate, the validator could receive manipulated information about the block it was preparing to propose.

According to Teku, such an attack could cause a validator to propose a block that directs transaction fees to an address controlled by the attacker.

Teku and Besu release fixes for affected Ethereum nodes

Following the disclosure, Teku released version 26.10.3 to remove four certificate roots from its Docker images, including emSign ECC Root CA G3, emSign Root CA G1, emSign Root CA G2 and AAA Certificate Services.

Besu introduced the same certificate removals in version 26.10.2, addressing the risk for operators using its updated Docker images.

However, the releases do not automatically update Java installations maintained separately by node operators.

Users running Teku or Besu through standalone binary distributions must check their installed Java runtime and update its trusted certificates where necessary.

Teku warned that operators still using Java 26 would need to migrate to Java 25 because the former version had reached end of life and would not receive the required patched build.

The advisory further identified certain testnet configurations as potentially exposed, including setups that download their initial blockchain state over HTTPS.

View sources >> Ethereum clients patch flaw that could redirect ETH rewards