CVE-2026-40583

HighPublic PoC

Published: 21 April 2026

Published

21 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS Score 0.0006 17.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40583 is a high-severity Improper Cleanup on Thrown Exception (CWE-460) vulnerability in Ultradag Ultradag. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations prior to state mutations, directly preventing non-council attackers from inducing unauthorized changes via SmartOp::Vote transactions.

SI-10 Information Input Validation good match

prevent

Validates all aspects of incoming SmartOp::Vote transactions, including authorization, before processing to block exploitation after initial prechecks.

AC-6 Least Privilege partial match

prevent

Applies least privilege to restrict state-mutating vote transactions to council members only, reducing the impact of delayed authorization checks.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1565.003 Runtime Data Manipulation Impact

Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Remote unauthenticated network exploitation of public-facing blockchain app (T1190) due to authorization check after state mutation enables runtime data manipulation (T1565.003) and availability disruption via app exploitation (T1499.004).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

Deeper analysisAI

CVE-2026-40583 is a vulnerability in UltraDAG, a minimal DAG-BFT blockchain implemented in Rust, affecting version 0.1. It enables a non-council attacker to submit a signed SmartOp::Vote transaction that passes initial signature, nonce, and balance prechecks but fails authorization only after state mutation has already occurred. The issue carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) and maps to CWE-460 and CWE-696.

A remote attacker requires no privileges, authentication, or user interaction to exploit this over the network with low complexity. Successful exploitation triggers unintended state mutation prior to authorization failure, resulting in low integrity impact and high availability disruption.

The UltraDAG core GitHub repository addresses the vulnerability via commits 2f5a3a237ea519b48d71e6e3093c89f60694c7be and 45bcf7064741897319b6196d3d9f9e1307093511, with additional mitigation details in security advisory GHSA-q8wx-2crx-c7pp.