Teku and Besu clients removed eMudhra certificate roots from Docker images to mitigate HTTPS interception risk affecting validator fee distribution.
Tech & Launches ·
Teku version 26.10.3 and Besu version 26.10.2, released in late October 2026, removed compromised eMudhra certificate roots from Docker images to block a potential attack vector where intercepted HTTPS connections could redirect validator fees. The vulnerability stems from eight eMudhra intermediate certificate authorities whose private keys became recoverable on October 17 and were revoked October 18; Java runtimes do not check revocation by default, leaving them exposed even after browsers blocked the certificates. Default mainnet Teku configurations with no HTTPS URLs in settings require no action, and no exploitation has been reported. Exposure risk varies by setup, with external signers and remote beacon nodes presenting the highest concern, while peer-to-peer networking remains unaffected.