Teku and Besu Patch Docker Trust Stores After eMudhra Certificate Weakness

Teku and Besu have released updates to address a certificate trust-store issue tied to eMudhra intermediate certificate authorities. The releases followed findings that private keys for eight eMudhra intermediates could be recovered from public certificates.

The weakness could allow an attacker who is able to intercept network traffic to present forged HTTPS certificates to affected Teku or Besu installations. The risk is tied to Docker images using Java trust stores that continued to trust the affected certificate chain.

Teku said a default mainnet node without HTTPS URLs in its configuration is not affected. The client team also said it had received no reports of exploitation.

The incident concerns HTTPS connections made by affected client deployments, rather than Ethereum consensus or execution rules themselves. Operators should assess whether their configurations use HTTPS endpoints covered by the trust-store exposure.

What researchers found

According to Teku’s security notice, the private keys of eight eMudhra intermediate certificate authorities were shown to be recoverable from their public certificates on October 17, 2026. Possession of those keys could enable the creation of certificates that appear valid to systems trusting the affected chain.

For Teku and Besu deployments using the relevant Java trust stores in Docker images, this created a risk that forged certificates could be accepted during HTTPS connections. Exploitation would require an attacker to be in a position to intercept the traffic.

Potential impact depends on configuration

The exposure is configuration-dependent. Teku stated that default mainnet nodes with no HTTPS URLs configured are not affected.

Teku further warned that, in certain affected validator configurations, a forged HTTPS connection could allow the redirection of validator fees or rewards. This is a potential consequence under those conditions, not a report of confirmed exploitation.

Teku said no exploitation had been reported at the time of its notice.

Client releases remove affected roots

Besu released version 26.10.2 on October 26, 2026. The release removed eMudhra-related roots from Besu Docker images.

Teku released version 26.10.3 on October 27, 2026, removing affected eMudhra-related roots from its Docker images. The changes are aimed at preventing the affected chain from being trusted in those containerized deployments.

The releases arrive during an active period of Ethereum client and testnet work. BTCNews.space has also covered the planned Hoodi testnet activation and its subsequent postponement.

• Besu: version 26.10.2, released October 26, 2026.
• Teku: version 26.10.3, released October 27, 2026.
• Both releases include Docker trust-store mitigations for eMudhra-related roots.

What the updates mean

The updates address certificate validation risk in affected Docker environments. They do not establish that an attack occurred.

Operators using Teku or Besu Docker deployments can review their HTTPS endpoint configurations and the client release notes to determine whether the mitigation applies to their setup. This is an operational security matter and not financial advice.

Continue reading: planned Hoodi testnet activation on BTCNews.

Continue reading: subsequent postponement on BTCNews.

Sources

• Teku: Teku security notice: eMudhra CA compromise
• Consensys: Teku releases
• Besu: Besu releases
• CoinDesk: Ethereum clients patch flaw that could let attackers redirect ether rewards

Our creator. Creates amazing NFT collections! Support the editor - Bitcoin_Man(TON) / Bitcoin Man Stickers(TON) / BM Numbers (TON) / Comics Book (TON) / Bitcoin_Man (ETH)

Pi Network (Guide)is a new digital currency developed by Stanford PhDs with over 55 million participants worldwide. To get your Pi, follow this link https://minepi.com/Tsybko and use my username (Tsybko) as the invite code.

Binance: Use this link to sign up and get $100 free and 10% off your first months Binance Futures fees (Terms and Conditions).

Bitget: Use this link Use the Rewards Center and win up to 5027 USDT!(Review)

Bybit: Use this link (all possible discounts on commissions and bonuses up to $30,030 included) If you register through the application, then at the time of registration simply enter in the reference: WB8XZ4 - (manual)