{"answers":{"affected":"3 open source packages ship an affected version, including anchor-lang.","exploited":"There is no known exploitation of GHSA-429q-fhh4-r6hj in the wild and no public exploit code.","fix":"Upgrade anchor-lang to 1.0.0-rc.2 or later.","what":"GHSA-429q-fhh4-r6hj is a missing authorization vulnerability in anchor-lang, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-429q-fhh4-r6hj and fix it if it is affected.\n\nWhat it is: GHSA-429q-fhh4-r6hj is a missing authorization vulnerability in anchor-lang, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-429q-fhh4-r6hj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- anchor-lang (crates.io): affected from 1.0.0-rc.1; fixed in 1.0.0-rc.2\n- anchor-lang (crates.io): affected from 1.0.0-rc.1; fixed in 1.0.0-rc.2\n- anchor-lang (crates.io): affected from 1.0.0-rc.1; fixed in 1.0.0-rc.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-429q-fhh4-r6hj/ (Markdown: https://insights.sbomify.com/GHSA-429q-fhh4-r6hj/index.md)","id":"GHSA-429q-fhh4-r6hj","markdown":"https://insights.sbomify.com/GHSA-429q-fhh4-r6hj/index.md","name":"GHSA-429q-fhh4-r6hj","record":{"aliases":["RUSTSEC-2026-0146"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["privilege_escalation","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Anchor Solana library","requires_auth":"none","summary":"Attackers can bypass account-type validation in Anchor programs, leading to incorrect authorization and state manipulation.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Affected versions of `anchor-lang` allowed `InterfaceAccount` to accept accounts\nwith an unexpected Anchor discriminator. A change to `InterfaceAccount` caused\nchecked deserialization to be bypassed for this account wrapper, so validation\nproved only that the account owner matched one of the accepted interface owners.\nIt did not prove that the account data belonged to the expected account type.\n\nPrograms using `InterfaceAccount` rely on Anchor to enforce both owner and\naccount-type validation before the handler runs. With discriminator checking\ndisabled, an attacker could pass another account type owned by an accepted\nprogram and have it deserialized through the expected interface wrapper. This\ncould bypass account-type assumptions made by the program and lead to incorrect\nauthorization or state handling.\n\nThe issue was fixed in `anchor-lang` 1.0.0-rc.2 by restoring checked\ndeserialization for `InterfaceAccount::try_from`, while keeping explicitly\nunchecked behavior available only through the unchecked API. Users should\nupgrade to `anchor-lang` 1.0.0-rc.2 or later.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"`InterfaceAccount` allows account substitution between unexpected types","id":"GHSA-429q-fhh4-r6hj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["1.0.0-rc.2"],"introduced":["1.0.0-rc.1"],"last_affected":[],"package":"anchor-lang","purl":null,"source":"GHSA-429q-fhh4-r6hj"},{"ecosystem":"crates.io","fixed":["1.0.0-rc.2"],"introduced":["1.0.0-rc.1"],"last_affected":[],"package":"anchor-lang","purl":"pkg:cargo/anchor-lang","source":"GHSA-429q-fhh4-r6hj"},{"ecosystem":"crates.io","fixed":["1.0.0-rc.2"],"introduced":["1.0.0-rc.1"],"last_affected":[],"package":"anchor-lang","purl":"pkg:cargo/anchor-lang","source":"RUSTSEC-2026-0146"}],"products":null,"published":"2026-05-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass account-type validation in Anchor programs, leading to incorrect authorization and state manipulation.","url":"https://insights.sbomify.com/GHSA-429q-fhh4-r6hj/"}