The Foundation’s operator advisory concerns software updates and protection of signing keys.
The Canton Foundation is urging validator and Super Validator operators to update software and review key protection after observing attempts to reach validator deployments through operators’ internal infrastructure.
The October 26 notice focuses on the systems companies run to participate in Canton. It describes attempted attacks and potential consequences, without identifying a victim or quantifying losses.
Patches and keys address different problems
A software update can fix known weaknesses in a program or its dependencies. Protecting signing keys addresses another risk: what an intruder could control after gaining access to an operator’s systems.
The advisory warns that locally held root keys, or large CC balances controlled by keys inside a node, can expose the node or funds if that infrastructure is compromised.
- Patch software: use updated components that address known vulnerabilities.
- Separate key protection: review where signing authority is held and who can access it.
Software updates and key protection address different parts of the Foundation’s October 26, 2026 UTC operator guidance. Sources: operator advisory and key-management guide.
Wallet Gateway has a specific update request
Earlier on October 26, Digital Asset issued a separate Wallet Gateway upgrade request for version 1.13.0. Its notice locates the issue in the bundled Node.js runtime, the software that runs JavaScript, rather than in Wallet Gateway’s own code.
The linked Node.js security advisory describes a flaw in handling compressed data that could allow an attacker’s code to run. Node.js rates that issue high severity. The warning does not establish that Wallet Gateway has been successfully exploited.
For bundled Docker Compose or Kubernetes/Helm deployments, the Gateway notice says its service can be updated independently of other Splice services. Users running the NPM package must also update the local Node.js runtime.
Key protection needs deployment planning
A signing key is a secret credential used to approve actions. A root namespace key can authorize changes to the node’s identity and the keys allowed to act for it. Canton’s key-management guide describes keeping it offline, away from the running node, and delegating routine authority to another key.
The Foundation also recommends external key management. A key-management system, or KMS, generates and stores keys separately from the node’s ordinary database.
The current validator security guide has two important setup conditions:
- It covers Kubernetes/Helm deployments. KMS is not currently supported for Docker Compose deployments.
- An existing non-KMS node cannot simply be switched to KMS operation. The recommended migration uses a fresh validator.
The advisory says further step-by-step migration guides are being prepared. Operators should use the official guide for their deployment rather than treating key protection as a settings-only change.
Keep upgrade notices tied to their network
The advisory names Splice 0.9.4 and Wallet Gateway 1.13.0 among the patched components. The Splice release incorporates Canton 3.6.4’s certificate updates, removing compromised eMudhra certificates from Docker images.
A separate October 26 readiness notice concerns DevNet: two-thirds of Super Validator nodes had upgraded, including the Foundation’s node. That establishes DevNet deployment readiness, not completion by every validator or a MainNet-wide rollout.
For its own customers, Blockdaemon has scheduled Wallet Gateway 1.13.0 maintenance for November 2, 10:00–11:00 UTC across DevNet, TestNet and MainNet. The provider expects no downtime. This is a future provider schedule, separate from the Foundation’s warning.
The advisory also asks operators to monitor logs and CC balances and have incident-response plans ready. Teams that suspect compromise are directed to the Foundation’s security contact and the official incident guidance.
Primary sources: the Foundation operator advisory, Wallet Gateway notice and validator security guide. Reporting cutoff: October 27, 2026 at 03:48 UTC.
