Ethereum Validator Reward-Theft Flaw Prompts Emergency Teku, Besu Updates
Summary
- A security vulnerability that could allow attackers to steal Ethereum validators' block rewards was discovered, prompting Teku and Besu to issue emergency security updates.
- The report said that if an attacker intercepts communications between a validator and an external service using a forged certificate, block production fees and the reward recipient address could be redirected to the attacker's address.
- The Teku development team said nodes running with default settings on Ethereum mainnet are unaffected, while recommending that operators not using Docker update their Java environments and migrate from Java 26 to Java 25.
Forecast Trend Report by Period
A security vulnerability that could allow attackers to divert Ethereum validator block rewards has been discovered, prompting major client development teams to issue security updates.
CoinDesk reported on October 29 that Ethereum clients Teku and Besu released versions 26.10.3 and 26.10.2, respectively, to address a certificate-related vulnerability tied to Indian digital certificate authority eMudhra. The key change removes trust for eMudhra-related certificates from Docker images.
The issue surfaced after it was confirmed on October 17 that private keys used by eight intermediate certificate authorities under eMudhra had been generated without sufficient randomness. Because those keys could be inferred from public certificates alone, attackers could potentially issue fake certificates posing as legitimate ones. Major web browsers later blocked the affected certificates, and eMudhra revoked them.
The vulnerability could enable theft of Ethereum validator rewards. If an attacker intercepts communications between a validator and an external service while posing as a legitimate provider, block production fees could be routed to the attacker's address. If an external signing service that separately manages a validator's private key is spoofed, signatures used to change the reward recipient address could also be abused.
Another issue is that Java, the programming language used by Teku and Besu, does not check certificate revocation status under its default settings. As a result, some Teku Docker environments continued to trust the affected certificates even after major web browsers blocked them.
No actual attack or theft of funds has been reported so far. In a security advisory, the Teku development team said Teku nodes running on the Ethereum mainnet with default settings are not affected and require no additional action.
The developers recommended that operators running Teku or Besu directly rather than through Docker update their Java environments separately. They also said Java 26, which is no longer supported, does not receive security patches and should be replaced with Java 25.
