Optimism Ships op-reth v2.6.1 Fix for eMudhra Certificate Flaw

Optimism published op-reth v2.6.1 on October 22, 2026, a release its maintainers flagged as strongly recommended for all operators because it carries "security fixes for the compromised eMudhra certificate authority (CVE-2026-111943)." The release notes state that op-reth no longer trusts the compromised intermediate certificates and that its container image drops trust in the eMudhra root entirely.

What the op-reth release notes confirm about the eMudhra flaw

The op-reth maintainers describe the issue plainly: a certificate authority operated by eMudhra had its intermediate certificates compromised, and the underlying weakness is tracked under CVE-2026-111943. Per the op-reth v2.6.1 release notes, the fix updates the rustls-webpki dependency from version 0.103.15 to 0.103.16, which is also tracked separately as advisory RUSTSEC-2026-0382. With that update, op-reth "rejects the compromised eMudhra intermediate certificates on its outbound TLS connections," and the container image no longer trusts the eMudhra root certificate authorities at all.

The release notes do not name the researcher who first identified the compromised keys, do not specify how many certificates were affected, and do not describe the technical mechanism by which the keys were recoverable. CoinsCipher could not independently verify those details through eMudhra's own channels or other primary sources at the time of writing, so this article does not speculate on them beyond what the op-reth maintainers themselves disclosed.

op-reth is Optimism's Rust-based execution client for OP Stack chains, built on Paradigm's Ethereum execution layer, reth. Paradigm's own upstream reth client has had an active release cadence through October. reth v2.8.0, published October 20, 2026, schedules the Amsterdam hardfork on the Hoodi testnet and adds an opt-in prewarm-result-reuse feature that Paradigm's release notes say reduced mean latency by 12.35% and raised throughput by 18.58% across 500 replayed blocks. The prior release, reth v2.7.0, published September 28, 2026, had separately prepared the Sepolia testnet for the same Amsterdam fork and carried a hard upgrade deadline of October 6, 2026, 13:53:36 UTC for Sepolia node operators, per that release's own notes.

What node operators should check

The eMudhra flaw, as described in op-reth's own notes, is not specific to Ethereum infrastructure — it touches any software relying on the rustls-webpki library, or more broadly any certificate-verification stack, for outbound TLS connections to compromised endpoints. The op-reth release notes do not state whether any malicious use of the compromised certificates has occurred; they describe a defensive fix against trusting certificates that should no longer be trusted, not a confirmed exploit against op-reth users.

Operators running op-reth as their OP Stack execution client can apply the fix by upgrading to v2.6.1, per the maintainers' own "strongly recommended" guidance. Those running other software that depends on system- or language-level certificate stores should separately confirm, through that software's own release notes or advisories, whether it has adopted equivalent fixes, since an op-reth upgrade alone does not cover other dependencies on a node's host system. CoinsCipher's wallets coverage will track whether other Ethereum execution or consensus clients publish comparable advisories tied to the same certificate authority issue.