Ethereum clients Teku and Besu patch flaw that could redirect validator fees
Ethereum clients Teku and Besu shipped updates removing trust in compromised eMudhra certificates that could let attackers redirect validator rewards.
ETHEREUMSECURITY & HACKSNEWS
Lukas Brenner
10/29/20261 min read
Ethereum consensus client Teku and execution client Besu have released updates that close a weakness which could have let attackers redirect validator rewards, CoinDesk reported on Oct. 29. Besu 26.10.2, released on Monday, and Teku 26.10.3, released on Tuesday, stop trusting certificates tied to Indian certificate authority eMudhra in their Docker images.
The problem traces back to a cryptography error at eMudhra. The private keys behind eight of its intermediate certificate authorities were generated with too little randomness, which meant they could be derived from the public certificates. Researchers found the issue on Oct. 17. Browsers blocked the certificates and eMudhra revoked them a day later, and the company has said it will exit the certificate business.
Java does not check certificate revocation by default, so Teku's Docker images kept trusting the compromised certificates after browsers had dropped them. Consensys Diligence, Teku's security partner, first flagged the issue.
How rewards could be diverted
An attacker sitting between a validator and an external service could have impersonated that service. According to Teku, a validator could then propose a block that pays its fees to the attacker's address. A fake external signer could also return signatures that change where rewards go, the configuration Teku ranked as the riskiest. Default Teku mainnet nodes were not affected, and the team said no exploitation has been reported.
Operators running the clients in Docker are advised to pull the latest images. Those running the software directly have to update Java on the host themselves, because the new images do not fix it. Teku said Java 26 has reached end of life without a patched build, so affected operators need to move to Java 25.
The patch adds to a busy stretch for Ethereum's core teams. Developers also merged a specification fix this week for a separate staking deposit flaw in the planned Glamsterdam upgrade, AMBCrypto reported, while the upgrade's Hoodi testnet activation remains postponed with no new date.
Source: CoinDesk, Teku, AMBCrypto