Ethereum clients patch flaw that could redirect ETH rewards
Share Link copied Ethereum client developers Teku and Besu have released security updates to address a certificate vulnerability that could allow attackers to impersonate services used by validators and potentially redirect their block rewards. SummaryEthereum clients Teku and Besu have released security updates after a certificate vulnerability was found that could allow attackers to redirect validator block rewards to their own addresses.The vulnerability originated from weak cryptographic keys associated with eight certificate authorities operated by Indian company eMudhra, which could allow attackers to create fraudulent certificates.Teku warned that attackers could impersonate external services used by Ethereum validators and manipulate block proposals or obtain sensitive validator signatures under certain configurations.Default Teku mainnet configurations were not affected, and developers confirmed that no exploitation of the vulnerability had been reported.Operators using standalone Teku or Besu installations must update their Java environments separately, as the latest Docker image fixes do not automatically update locally installed Java certificates. According to security advisories accompanying the releases, the issue originated from compromised certificate authority keys belonging to Indian digital certificate provider eMudhra, which left certain Ethereum node configurations exposed to forged HTTPS connections. Teku released version 26.10.3 on October 27, while Besu introduced version 26.10.2 a day earlier. Both updates remove trust





