Security· ★★★· neutral·

Teku 26.10.3 strips compromised certificate roots from Docker images

  • —Docker images drop trust in emSign ECC Root CA-G3, emSign Root CA-G1, emSign Root CA-G2 and AAA Certificate Services
  • —Only HTTPS connections are affected: external signers, remote beacon or execution endpoints, builders
  • —Peer-to-peer networking does not use certificate authorities and is outside the exposure
  • —No exploitation reported; wallet spending keys and validator signing keys are not automatically compromised
Why it matters: Teku node operators should update to 26.10.3 and audit HTTPS endpoints in their configuration to prevent service impersonation.
Source: Bitcoin Insider