Obol Urges Immediate Charon Upgrade After CA Key Compromise

Obol released Charon v1.11.2 on Oct. 21, urging Ethereum mainnet distributed-validator operators to upgrade immediately to address compromised certificate-authority keys used in server authentication.

“Mainnet operators are encouraged strongly to update to this release ASAP,” Obol said on X. Its release notes call the patch “a required release for all Operators.” The fix updates Go's certificate checks so affected certificate chains are rejected, according to the Go team's security announcement.

Charon lets multiple operators coordinate Ethereum validator duties as a single distributed validator. Obol's mainnet data API reported total cluster balances of 422,862 ETH, valued at about $1.05 billion, in a snapshot timestamped Oct. 20 at 8 p.m. ET.

Server Impersonation Risk

The patch upgrades Charon's Go toolchain from 1.26.6 to 1.27.3 and removes trust in the emSign ECC Root CA - G3 and AAA Certificate Services roots from its runtime image. The certificate issue is tracked as CVE-2026-111943.

The underlying incident involves eight eMudhra intermediate certificate authorities. In its public incident record, Mozilla said it received a compromise report on Oct. 17 and independently recovered the affected private keys, confirming that their generation was flawed and trivial to exploit.

For an unpatched operator, the risk is that an attacker able to intercept or redirect an affected HTTPS connection could impersonate a server and read or modify traffic if the client still trusts the compromised keys. Cisco Talos's advisory describes that attack and warns that applications outside browsers may need their own updates.

A forged web certificate alone does not grant access to validator signing keys or admission to a Charon cluster. Obol's networking documentation says peer connections use Noise encryption and accept only peers identified in the cluster lock file. Charon also uses HTTPS requests to discover relay addresses, making web authentication a separate part of its communications.

Obol's architecture documentation says validator key shares are held by separate validator clients, with Charon aggregating a threshold of partial signatures.

Talos said it had seen no malicious incidents involving the certificates as of 10 a.m. ET on Oct. 21.

The mainnet patch is not ready for Ethereum's Glamsterdam upgrade; its release notes say another upgrade will be required before the network's hard fork. Hoodi testnet operators have a separate required upgrade, v2.0.0-rc2. Those notes tell mainnet operators to wait for a full v2.0.0 release or newer.