# Teku Details Conditional Ethereum Node Risk From eMudhra Certificates By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/43527 Published: 2026-10-29T13:00:51.000Z Updated: 2026-10-29T13:00:51.000Z Section: Technology > eMudhra described a separate U.S. transition involving about 30,800 certificates issued under affected G3 hierarchies; the update did not identify them as certificates used by Ethereum nodes. Teku outlined a conditional route to Ethereum validator fee diversion through affected HTTPS certificate trust, requiring a vulnerable Java setup and an attacker able to intercept the connection. Separately, eMudhra described an ongoing U.S. certificate transition; its update did not identify those customer certificates as being used by Ethereum nodes. The transition covers about 30,800 certificates issued under affected G3 hierarchies within a U.S. customer ecosystem. eMudhra said the ecosystem is moving to an alternate issuance path through its G1 RSA root. The figure is not a count of Ethereum validators or certificates issued by the eight weak intermediate certificate authorities. The eight intermediates were created April 30, 2025. The Go Security team found that their private keys could be reconstructed from public certificates in microseconds, creating a way to forge certificates and impersonate a service if an attacker could intercept network traffic. eMudhra said seven intermediates were never used in production and the one that was used issued no certificates. Teku said exposure depends on a node connecting to another host over HTTPS with a Java runtime that still trusts an affected certificate chain, while an attacker can intercept that connection. Teku described a possible scenario in which an attacker impersonates a remote beacon node and supplies data that leads a validator to propose a block directing fees to the attacker. Teku said a default mainnet node with no HTTPS URLs was unaffected and that it had received no exploitation reports as of Oct. 28. Teku is Ethereum’s consensus client, while Besu handles execution. Release listings for Teku 26.10.3 and Besu 26.10.2 describe Docker image changes removing trust in four roots: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and AAA Certificate Services. The listed release dates are Oct. 27 for Teku and Oct. 26 for Besu. The [Docker image trust changes]() followed earlier [Ethereum operator guidance on the certificate risk](). Besu’s change applies only to Docker images; archive users may rely on a separately supplied Java runtime. Teku’s Oct. 28 notice still directed Docker users to await a fixed image, so the release listing alone does not establish the status of every deployed image. eMudhra described its certificate transition as ongoing. ## Links in this article - [Docker image trust changes](https://www.tokenpost.com/news/technology/42976) - [Ethereum operator guidance on the certificate risk](https://www.tokenpost.com/news/technology/40927)