A key-generation error at Indian certificate authority eMudhra left eight of its intermediate certificates with recoverable private keys, and two Ethereum clients have now shipped fixes. The intermediates were revoked on Oct. 18, but Java does not check revocation by default, so Java-based nodes kept trusting them.

Teku 26.10.3 and Besu 26.10.2 stop their Docker images from trusting four affected certificate roots. Operators running binary installs must check and fix their own Java runtime separately, since updating the client alone does not change it.

On an unpatched setup, an attacker who intercepts an HTTPS connection could impersonate a remote beacon node and redirect validator proposal fees, or cause missed duties.

Default mainnet nodes without HTTPS endpoints or TLS options are not affected, and both teams say no exploitation has been reported. Besu flags nodes that accept CA-signed RPC clients as the highest-risk case, as they can be accessed with no interception at all.