Teku and Besu have released security updates after weak cryptographic key generation exposed private keys for eight intermediate certificate authorities operated by eMudhra. An attacker holding those keys could issue forged certificates that affected software would accept as legitimate.
Teku 26.10.3 removes the related eMudhra roots from its Docker image. Besu 26.10.2 makes the same change. Operators using standalone archives or their own Java distribution must update the Java trust store separately because replacing the Ethereum client alone does not modify the host runtime.
The exposure depended on configuration. CoinDesk reported that default Teku mainnet nodes were not affected and no exploitation has been reported. A validator using affected HTTPS services, builders or external signers could have been redirected to an impersonated endpoint. In the highest-risk scenario, forged connections could alter fee-recipient information or obtain signatures used for validator actions. coindesk.com
Java does not check certificate revocation by default in this setup, so eMudhra’s revocation did not automatically remove trust from every client environment. Teku also warned that Java 26 is end of life and operators on it need to migrate to Java 25.
TOKEN RECON ASSESSMENT
This is a dependency failure at the boundary between blockchain software and ordinary public-key infrastructure. Ethereum’s consensus and peer-to-peer protocols were not broken, but validator operations can still be compromised through trusted external services. The confirmation threshold is operational: client version, Java trust-store state, certificate chain and external-signer configuration must all be checked. A patched Docker image does not prove a separately installed Java environment is safe.
