Teku 26.10.3: security release for Ethereum node operators
Teku 26.10.3 (released 2026-10-27) includes security fixes according to its release notes. Ethereum node operators running Teku should review and upgrade.
Vuln-watch · relayed from an upstream security release; see Source & attribution below
Summary
Teku 26.10.3 (released 2026-10-27) includes security fixes according to its release notes. Ethereum node operators running Teku should review and upgrade.
Affected
- Teku (Consensys/teku) versions before 26.10.3
From the release notes
This is a recommended update addressing the recent CVE-2026-111943 (eMudhra compromised keys) For more information, read our security advisory. ## Additions and Improvements - Docker images no longer trust the emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 or AAA Certificate Services roots, which OpenJDK removed after the eMudhra intermediate certificate authorities were compromised in October 2026. The Eclipse Temurin base images do not include this fix yet.
Recommended actions
- Upgrade Teku to 26.10.3 or later
- Check the release notes for any coordinated upgrade deadline or required configuration change
Source & attribution
This 0xCERT advisory relays the Teku 26.10.3 release notes: https://github.com/Consensys-Incorporated/teku/releases/tag/26.10.3. Refer to the upstream project for the authoritative record and any follow-up security advisories.
References
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-27 · last updated 2026-10-27
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0280/signed.txt | gpg --verify