CVE-2026-28402

Deeper analysis

CVE-2026-28402 affects nimiq/core-rs-albatross, a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm, in versions prior to 1.2.2. The vulnerability arises in macro block proposal verification, where a proposer can submit a proposal with a `header.body_root` that does not match the hash of the actual macro body. The verification process checks the header but skips validating the binding between `body_root` and `hash(body)`, allowing the malformed proposal to pass initial checks. Subsequent code assumes this binding holds true, potentially triggering a panic and crash on validator nodes when processing the mismatch. This issue is classified under CWE-354 (Improper Validation of Integrity Check Value) with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

Exploitation requires a malicious or compromised validator to be elected as proposer, granting low-privilege (PR:L) network access (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The attacker publishes the tampered macro block proposal, which validators accept during proposal verification but fail to process correctly later, leading to panics and crashes. This results in a denial-of-service on affected validator nodes, with high availability impact (A:H) and low integrity impact (I:L), but no confidentiality loss (C:N). The scope remains unchanged (S:U), and impacts are limited to validator nodes only.

The patch, released in version 1.2.2, adds explicit verification of the `body_root == hash(body)` binding during proposal checks, as detailed in the GitHub security advisory (GHSA-7wh6-rmxx-ww47), pull request #3623, commit 6454c26d966858c5520f55739a30b94c17656c85, and release notes. No workarounds are available.