CVE-2026-62162

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62162", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T14:16:29.572Z", "datePublished": "2026-10-30T18:30:20.005Z", "dateUpdated": "2026-10-30T22:17:11.419Z"}, "containers": {"cna": {"title": "Hydra: Deposit Claim omits Head state-token spending requirement", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5"}, {"name": "https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0", "tags": ["x_refsource_MISC"], "url": "https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0"}, {"name": "https://github.com/cardano-scaling/hydra/releases/tag/2.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/cardano-scaling/hydra/releases/tag/2.1.0"}], "affected": [{"vendor": "cardano-scaling", "product": "hydra", "versions": [{"version": "< 2.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T18:30:20.005Z"}, "descriptions": [{"lang": "en", "value": "Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0."}], "source": {"advisory": "GHSA-gfpc-m687-p7h5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T21:18:05.207328Z", "id": "CVE-2026-62162", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T22:17:11.419Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62162", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T21:18:05.207328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T21:18:06.084Z"}}], "cna": {"title": "Hydra: Deposit Claim omits Head state-token spending requirement", "source": {"advisory": "GHSA-gfpc-m687-p7h5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "cardano-scaling", "product": "hydra", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "references": [{"url": "https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5", "name": "https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0", "name": "https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cardano-scaling/hydra/releases/tag/2.1.0", "name": "https://github.com/cardano-scaling/hydra/releases/tag/2.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T18:30:20.005Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62162", "state": "PUBLISHED", "dateUpdated": "2026-10-30T22:17:11.419Z", "dateReserved": "2026-07-13T14:16:29.572Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-30T18:30:20.005Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hydra", "vendor": "cardano-scaling", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0."}], "id": "CVE-2026-62162", "lastModified": "2026-10-30T23:17:12.113", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62162", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T21:18:05.207328Z", "version": "2.0.3"}}]}, "published": "2026-10-30T19:18:32.630", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0"}, {"source": "security-advisories@github.com", "url": "https://github.com/cardano-scaling/hydra/releases/tag/2.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hydra: Hydra: Theft of pending deposits via improper transaction validation", "id": "2564249", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564249"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-807", "details": ["Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.", "A flaw was found in Hydra. A remote attacker can intercept and steal committed funds by observing pending deposit transactions on the network. Because the deposit verification logic fails to properly constrain transaction outputs or verify protocol state, an attacker can submit a transaction claiming the deposit before the deadline expires. Successful exploitation allows unauthorized actors to bypass protocol security controls and redirect the assets to an arbitrary address."], "name": "CVE-2026-62162", "public_date": "2026-10-30T18:30:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62162\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62162\nhttps://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0\nhttps://github.com/cardano-scaling/hydra/releases/tag/2.1.0\nhttps://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5"], "statement": "Red Hat rates this flaw as Important because an unauthenticated network adversary can siphon deposited funds by submitting unauthorized claims prior to window expiration. This risk is classified in this severity band due to the high integrity impact and lack of required privileges, which allows complete diversion of assets. However, this Cardano scalability project is not part of Red Hat Enterprise Linux or any supported Red Hat portfolio offerings.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hydra", "source": "cna", "vendor": "cardano-scaling"}, "product": "hydra", "vendor": "cardano-scaling"}], "created": "2026-10-30T19:45:14.210452+00:00", "updated": "2026-11-04T11:15:08.427173+00:00", "vendors": ["cardano-scaling", "cardano-scaling$PRODUCT$hydra"]}