High severity8.2NVD Advisory· Published Apr 21, 2026· Updated Apr 27, 2026

CVE-2026-40583

Description

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ultradag/Ultradag2 versions
cpe:2.3:a:ultradag:ultradag:0.1.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ultradag:ultradag:0.1.0:*:*:*:*:*:*:*
- (no CPE)range: =0.1

Patches

Vulnerability mechanics

References

github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7benvdPatch
github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511nvdPatch
github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7ppnvdExploitMitigationVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000