Teku 26.10.3 drops eMudhra roots after CA keys were cracked
Serguey Asael Shinder2 min readA weakness in an Indian certificate authority's keys has reached Ethereum's consensus clients. Teku, the Consensys consensus client, released version 26.10.3 on 27 October as a recommended update addressing CVE-2026-111943. Its Docker images no longer trust four root certificates from eMudhra's emSign brand and from Sectigo, which OpenJDK removed after eMudhra's intermediate certificate authorities were compromised.
According to Teku's security advisory, the private keys of eight emSign intermediate authorities were shown on 17 October to be recoverable from their public certificates. They were revoked the next day, and browsers, operating systems and Go blocked them. Java, however, does not check revocation by default, so any Java runtime without OpenJDK's two fixes, issued on 20 and 23 October, would accept a certificate forged with those keys. That includes every Teku Docker image up to 26.10.2.
The advisory is specific about exposure. A default mainnet node, with no https:// URLs in its configuration, is not affected and needs no action; peer-to-peer networking does not use certificate authorities. Teku is affected when it connects over HTTPS to another host: an external signer, a remote beacon node for a validator client, a proposer configuration loaded from a URL, a builder or relay, or checkpoint and genesis data downloaded at start. An attacker who can intercept that traffic could impersonate the endpoint. Through a remote beacon node, validators could be made to propose blocks that pay fees to the attacker; through a fake external signer, the attacker could obtain voluntary exit signatures, which are irreversible. No exploitation has been reported.
Docker users should move to the new image. Operators who run Teku directly must fix their own Java installation, and Java 26 is end of life, so they need to move to Java 25. CoinDesk reports that Besu released a corresponding update, 26.10.2.
What it means
The incident shows a supply chain that rarely gets attention: validator software inherits its trust decisions from the runtime it ships with. Revocation worked for browsers within a day; Java users depended on a runtime update that took another week to reach images. Setups that keep signers and beacon nodes on localhost or a private network were always much less exposed.