Teku and Besu, software used to run Ethereum nodes, have released Docker security fixes following a certificate-authority compromise at eMudhra. Operators using affected images can update those containers, while binary installations require a separate check of their Java runtime.
Docker fixes remove four certificate roots
Teku 26.10.3, released Oct. 27, and Besu 26.10.2, released Oct. 26, stop their Docker images from trusting four certificate roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services.
For Teku, exposure depends on configuration. The team's security notice says default mainnet nodes without HTTPS URLs are unaffected. On an unremediated runtime, an attacker would need to intercept an affected HTTPS connection to impersonate its endpoint. The notice reports no exploitation.
Underlying incident and revocation gap
The incident involved recoverable private keys for eight emSign G3 intermediate certificate authorities. eMudhra acknowledged a script error that produced weak keys and said the intermediates were revoked after the Oct. 17 report. Teku's advisory says Java does not check revocation by default, so affected runtimes still need their own remediation.
What operators need to check
The new client images address their bundled trust stores, the lists of certificate authorities Java accepts. Teku's notice identifies all its Docker images through 26.10.2, including the -jdk25 and -jdk26 variants, as retaining the implicated emSign ECC root. Updating Java on the host does not change the runtime inside those containers.
Besu explicitly limits its root-removal change to Docker images: its tar/zip users may still have a JDK that trusts the roots. Teku's binary distribution likewise uses the Java runtime installed by its operator. These installations need that runtime checked and, if it remains affected, fixed separately from the client software.
Affected HTTPS dependencies and potential impact
Teku's HTTPS dependencies can include remote signers, beacon nodes, execution clients and builders or relays, as well as proposer configuration, startup data and metrics services. The notice also flags Sepolia, Hoodi and Ephemery, which download starting state over HTTPS when launched with an empty database.
On an unremediated runtime, an attacker who intercepts the connection could impersonate a remote beacon node. That could redirect proposal fees or cause missed validator duties. An attacker impersonating an exposed external signer could obtain signatures for validator exits. The notice says mutual TLS client authentication at the signer limits its impact to denial of service.
Teku's peer-to-peer networking, including libp2p and discv5, does not use certificate authorities and is outside this issue.
