Vulnerability in Ultradag
CVE-2026-40583
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.
EPSS exploit prediction
EPSS: 0.006 (46.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
- Ultradag — versions 0.1.0
- Ultradagcom Core — versions = 0.1
Weakness classification (CWE)
References
- github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp (Exploit, Mitigation, Vendor Advisory)
- github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be (Patch)
- github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511 (Patch)
Frequently asked questions
- What is CVE-2026-40583?
- CVE-2026-40583 is a high-severity vulnerability in Ultradag, classified under CWE-460. CVSS score: 8.2/10. Published 2026-04-21.
- How severe is CVE-2026-40583?
- High severity. CVSS v3 base score is 8.2 out of 10.