Ethereum client releases security update to fix eMudhra certificate vulnerability, default mainnet nodes unaffected.

BlockBeats news, October 29: A cryptographic security vulnerability in Indian certificate authority eMudhra has affected Ethereum clients Teku and Besu. Researchers found that the private keys of 8 intermediate certificate authorities under eMudhra may be inferable due to insufficient randomness, allowing attackers to potentially forge certificates and trick unpatched software into trusting malicious services.

Teku has released version 26.10.3, and Besu has released version 26.10.2, both removing trust in the relevant certificates from their Docker images. If an attacker carries out a man-in-the-middle attack, they could trick some validators into sending block fee rewards to the attacker's address; under specific configurations using external signers, the risk may be higher.

The Teku team stated that Ethereum mainnet Teku nodes with default configurations are unaffected and require no action, and there are currently no reports of the vulnerability being exploited. For operators running Teku or Besu directly on the host without using Docker, updating the client alone may not be enough; they also need to manually update Java and its trusted certificate list. Operators still using the discontinued Java 26 will need to migrate to Java 25.