CVE-2026-106511 CVE-2026-106511
Attackers with Proposer role can drain all funds from MultiversX multisig contracts due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-106511?
CVE-2026-106511 is a critical missing authorization vulnerability in MultiversX Labs S.R.L. multisig-improved, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
Which versions are affected by CVE-2026-106511?
How do I fix CVE-2026-106511?
No fix has been published for CVE-2026-106511 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-106511 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106511 exists.
Sources
Also known as GHSA-vxx8-8p7v-9mvp.