Obol Network has released an urgent upgrade for its Charon client, urging mainnet operators to update immediately following a compromise of intermediate certificate authority (CA) certificates tied to the eMudhra incident. The patch, Charon v1.11.2, was shipped on October 21, 2026.
The stakes are significant: Obol’s mainnet cluster balances totaled 422,862 ETH in its latest daily snapshot, and that capital runs through the very client being patched.
What Charon v1.11.2 changes
The release centers on certificate validation. It upgrades the Go programming language version underneath Charon, which updates how the client checks certificates and corrects known vulnerabilities connected to the CA compromise. It also distrusts specific roots inside the Docker image that operators use to deploy Charon. In effect, the software now refuses to vouch for certain certificate issuers it previously would have accepted.
Obol is strongly recommending that mainnet operators running the Go-based Charon client upgrade immediately.
A browser-sized problem lands on Ethereum staking
The broader incident was reported around October 17, 2026, and has been designated CVE-2026-111943. CVE identifiers are the standard catalog numbers the security world uses to track publicly disclosed vulnerabilities. Mozilla, Google, Apple, and Microsoft have taken steps to block the affected CA roots. Obol’s patch puts Charon in line with that industry response. The distinction is that browsers protect people reading websites, while Charon protects machines coordinating Ethereum validators.
Charon is middleware for distributed validators. Rather than one operator running a validator alone, Charon lets several operators share the job in a fault-tolerant setup. It does this through distributed key generation, or DKG. The technique splits a validator’s key into shares spread across operators, so the full private key never sits in one location. That design reduces single points of failure. But the communication between those keyholders still depends on trust infrastructure, which is exactly where certificate validation comes into play.
Background on Obol’s security posture
Obol has leaned heavily on outside reviews over its lifetime. The project has undergone several audits, including work by firms such as Trail of Bits and Quantstamp, focused on areas like DKG and key management.
What this means for operators and stakers
For node operators, the action item is simple: upgrade to v1.11.2. Any cluster still running an older version keeps trusting certificate roots that the major browser and operating system vendors have moved to block.
For stakers whose ETH sits in Obol-powered clusters, the 422,862 ETH figure frames the exposure. That balance does not mean funds are at risk today, and nothing in the disclosure says any funds were affected.
Speed of response is the other signal worth noting. The CA compromise was reported around October 17, and Obol shipped its fix on October 21. For infrastructure that has to navigate Go toolchain updates and Docker image changes, a four-day turnaround is a reasonable showing.
