Obol released Charon v1.11.2 and urged Ethereum mainnet distributed-validator operators to upgrade immediately after compromised certificate-authority keys surfaced. The patch changes how Charon checks certificates. Obol's mainnet cluster balances totaled 422,862 ETH in its latest snapshot.
Obol released Charon v1.11.2 on Oct. 21, urging Ethereum mainnet distributed-validator operators to upgrade immediately to address compromised certificate-authority keys used in server authentication. According to Obol on X: "Mainnet operators are encouraged strongly to update to this release ASAP." The release notes call the patch a required release for all operators.
What the patch changes
The patch upgrades Charon's Go toolchain from 1.26.6 to 1.27.3 and removes trust in the emSign ECC Root CA – G3 and AAA Certificate Services roots from its runtime image. The certificate issue is tracked as CVE-2026-111943. According to the Go team's security announcement, the fix updates Go's certificate checks so affected certificate chains are rejected.
The underlying incident involves eight eMudhra intermediate certificate authorities. Mozilla said it received a compromise report on Oct. 17 and independently recovered the affected private keys, confirming that their generation was flawed and trivial to exploit.
Risk for unpatched operators
For an unpatched operator, an attacker able to intercept or redirect an affected HTTPS connection could impersonate a server and read or modify traffic if the client still trusts the compromised keys. Cisco Talos said it had seen no malicious incidents involving the certificates as of 10 a.m. ET on Oct. 21.
However, a forged web certificate alone does not grant access to validator signing keys or admission to a Charon cluster. Obol's documentation says peer connections use Noise encryption and accept only peers identified in the cluster lock file. Charon also uses HTTPS requests to discover relay addresses, which makes web authentication a separate part of its communications.
Obol's mainnet data API reported total cluster balances of 422,862 ETH, valued at about $1.05 billion, in a snapshot timestamped Oct. 20 at 8 p.m. ET.
Another upgrade is coming
The mainnet patch is not ready for Ethereum's Glamsterdam upgrade. Its release notes say another upgrade will be required before the network's hard fork, and they tell mainnet operators to wait for a full v2.0.0 release or newer. Hoodi testnet operators have a separate required upgrade, v2.0.0-rc2.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
