CVE-2026-46540
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LSummary
CVE-2026-46540 is a medium-severity Improper Enforcement of Behavioral Workflow (CWE-841) vulnerability. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-11 (Re-authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-35881
Vulnerability Data
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, when LightBlockchain::rebranch() adopts a fork chain whose tip is a macro block (checkpoint or election), it only updates self.head but…
more
fails to update self.macro_head, self.election_head, self.current_validators, or store the election header in the chain_store. This is in direct contrast with the full Blockchain::rebranch() at blockchain/src/blockchain/push.rs:504-518, which correctly updates all macro/election state when the new head is a macro block. After a rebranch to a macro block, the stale macro_head causes subsequent macro blocks pushed via push() to be verified against the wrong predecessor via verify_macro_successor(&this.macro_head). If the rebranch target was an election block, the stale current_validators causes every subsequent block to fail verify_validators(), completely stalling the light client's chain progression. This issue has been patched in version 1.4.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement can require each successive workflow step to present the proper authorization context before proceeding.
Re-authentication requirements can be placed at critical workflow steps to ensure the actor has performed prior behaviors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly address proper workflow enforcement during design and coding.
Enforcing authorization policies can include sequence constraints on multi-step actions.
Hardened configuration baselines can embed required workflow ordering rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect workflow bypasses but does not enforce them at runtime.
Secure development lifecycle requires explicit workflow enforcement in multi-step processes.
Application security requirements include sequencing and state-transition rules for critical workflows.
Secure architecture principles address proper ordering of security-critical operations.
Secure coding practices can prevent missing workflow checks but do not define the control itself.
Change management can require workflow adherence for changes but is not the primary mitigation.