Obol Network has released an urgent update for its Charon middleware, version 1.11.2, following a compromise of intermediate certificate authority certificates associated with the eMudhra incident. The vulnerability, tracked as CVE-2026-111943, was reported on October 17, 2026, and prompted a response from industry leaders including Google, Apple, Microsoft, and Mozilla.
The patch updates the Go programming language version used by Charon to improve certificate validation processes. Additionally, the new version removes trust for specific certificate roots within the Docker images used for deployment. This ensures the software no longer validates issuers that have been blocked by major browser and operating system vendors.
Charon serves as middleware for distributed Ethereum validators, utilizing distributed key generation to split validator keys across multiple operators. The latest snapshot indicates that Obol-powered clusters manage a total of 422,862 ETH. While there are no reports of compromised funds, the project strongly advises all mainnet operators to upgrade immediately to mitigate potential risks.
