Ethereum Security Flaw Exposes Validator Reward Theft Risk; Teku, Besu Issue Emergency Updates
Summary
- Ethereum clients Teku and Besu released new versions to address a security flaw that could enable theft of validator block rewards.
- The vulnerability stemmed from eMudhra certificates and Java's default settings, creating a risk that communications between validators and external services could be spoofed and the reward recipient address changed.
- The Teku development team said mainnet nodes running with default settings are unaffected, while advising operators to update their Java environments and migrate to Java 25.
Forecast Trend Report by Period
A security flaw that could allow attackers to steal Ethereum validator block rewards has prompted major client developers to release security updates.
Teku and Besu, two Ethereum clients, released versions 26.10.3 and 26.10.2, respectively, to address a vulnerability tied to certificates from Indian digital certification authority eMudhra, CoinDesk reported on October 29. The key change removes trust for eMudhra-related certificates in Docker images.
The issue surfaced after it was confirmed on October 17 that private keys used by eight intermediate certificate authorities under eMudhra had been generated without sufficient randomness. Because those private keys could be inferred from publicly available certificates, attackers may have been able to issue fake certificates disguised as legitimate ones. Major web browsers later blocked the affected certificates, and eMudhra revoked them.
The vulnerability could lead to theft of Ethereum validator rewards. If an attacker intercepts communications between a validator and an external service and impersonates a legitimate provider, block-building fees could be redirected to the attacker's address. The risk is especially acute if an external signing service that separately manages validator private keys is spoofed, because signatures used to change reward recipient addresses could be abused.
Another issue is that Java, the programming language used by Teku and Besu, does not check certificate revocation by default. As a result, some Teku Docker environments continued to trust the affected certificates even after major web browsers had blocked them.
No actual attacks or thefts have been reported so far. In a security advisory, the Teku development team said Teku nodes running on the Ethereum mainnet with default settings are not affected and do not require additional action.
The developers advised operators running Teku or Besu directly, rather than through Docker, to update their Java environments separately. They also said Java 26, which is no longer supported, does not receive security patches and should be replaced with Java 25.
Suehyeon Lee
shlee@bloomingbit.ioI'm reporter Suehyeon Lee, your Web3 Moderator.