CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
An attacker can drain the fee-payer wallet by submitting transactions with arbitrarily high gas prices, causing financial loss and service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59695?
CVE-2026-59695 is a high-severity vulnerability in ZenHive mpp, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price.
When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests.
This issue affects mpp: from 0.2.0 before 0.6.0.
Weakness: CWE-1284
Which versions are affected by CVE-2026-59695?
3 open source packages ship an affected version, including mpp.
| Package | Affected | Fixed in |
|---|---|---|
mpp Hex | From 0.2.0 | 0.6.0 |
mpp Hex | From 0.2.0 | 0.6.0 |
mpp Hex | From 0.2.0 | 0.6.0 |
How do I fix CVE-2026-59695?
Upgrade mpp to 0.6.0 or later.
Is CVE-2026-59695 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59695 exists.
Sources
Also known as EEF-CVE-2026-59695, GHSA-6v7f-h3qg-wwpp, GHSA-vv77-66rf-pm86.