What is the CVSS score of CVE-2026-28410?

CVE-2026-28410 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Graph Protocol Contracts are affected by CVE-2026-28410?

A critical vulnerability in The Graph's token vesting contracts allows unauthorized early access to locked tokens, potentially affecting organizations managing blockchain-based token distributions…. A patch is available.

How to fix or mitigate CVE-2026-28410?

Within 24 hours: Identify all systems running The Graph versions prior to 3.0.0 and assess token vesting contract exposure. Within 7 days: Apply the available patch to version 3.0.0 or later across all affected production and non-production environments. Within 30 days: Conduct a post-incident review of token vesting transactions to detect any unauthorized early token access during the vulnerability window.

Graph Protocol Contracts CVE-2026-28410

HIGH

Improper Access Control (CWE-284)

2026-03-05 security-advisories@github.com

Authentication Bypass Graph Protocol Contracts

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 10, 2026 - 16:54 nvd

Patch available

CVE Published

Mar 05, 2026 - 21:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.

AnalysisAI

Premature token unlock in Graph Protocol Contracts versions before 3.0.0 allows authenticated users to bypass vesting restrictions and access locked tokens before their scheduled release date. An attacker with valid credentials can manipulate the vesting contract logic to drain funds that should remain locked, resulting in unauthorized token theft. A patch is available in version 3.0.0.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Graph Protocol Contracts. The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.