Teku, Besu patch eMudhra flaw that could redirect ETH rewards

The Ethereum clients Teku and Besu have shipped updates that stop trusting certificates tied to Indian certificate authority eMudhra, closing a gap that in some setups could have let attackers redirect validators' block rewards, CoinDesk reported. Default Teku nodes on mainnet were not affected, and no attacks have been reported.

What was released

• Teku 26.10.3 (Tuesday): the consensus-layer client used by many validators.
• Besu 26.10.2 (Monday): the execution-layer client that processes transactions.

Both updates remove trust in eMudhra-linked certificates from their Docker images, the prepackaged builds many operators run.

Why Java was the weak point

On Oct. 17 researchers showed that the private keys of eight eMudhra intermediate certificate authorities had been generated with too little randomness and could be derived from the public certificates, the issue we explained in our eMudhra key breakdown. Browsers blocked the certificates and eMudhra revoked them a day later; the company has since said it will leave the certificate business.

Teku and Besu run on Java, which by default does not check whether a certificate has been revoked. So the old Docker images kept trusting the bad certificates after browsers had dropped them. Consensys had already warned Besu and Web3Signer operators about the risk.

How rewards could have been stolen

According to Teku's advisory, an attacker positioned between a validator and a service it relies on could impersonate that service:

• a validator fooled this way could propose a block that pays its fees to the attacker's address;
• a fake external signer, the service that holds a validator's keys, could return signatures that change where rewards go, which Teku rated the riskiest setup.

"A default Teku node on mainnet is not affected and needs no action," the team wrote. Consensys Diligence, Teku's security partner, first flagged the problem.

What operators should do

• Docker users: pull the latest Teku or Besu image.
• Bare-metal users: update Java separately; upgrading the client does not touch Java's trust store, and new Docker images do not fix Java installed on the host.
• Java 26 users: that release is end of life and will not get a patched build, so move to Java 25.

Home stakers who are unsure how their setup earns rewards can start with our guide to crypto staking.