CVE-2026-40583 UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt
Attackers can trigger a fatal halt in the UltraDAG blockchain by submitting unauthorized votes that mutate state before authorization checks fail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40583?
CVE-2026-40583 is a high-severity vulnerability in UltraDAGcom core, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
Which versions are affected by CVE-2026-40583?
It affects 1 product.
Products include Ultradag Ultradag.
How do I fix CVE-2026-40583?
No fix has been published for CVE-2026-40583 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40583 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40583 exists.
Sources
Also known as GHSA-q8wx-2crx-c7pp.