Hashgraph Guardian CVE-2026-39911

Attacker must possess authenticated Standard Registry user credentials with permissions to create or modify Custom Logic policy blocks within the Guardian platform. The Custom Logic policy block worker feature must be enabled and accessible to the attacker's user role - if Guardian deployments restrict this advanced policy feature to administrators only or disable it entirely, the attack surface is eliminated. Exploitation requires no user interaction (UI:N) and works against default Guardian container configurations that store sensitive credentials in process environment variables. The authentication requirement (PR:L) limits exploitation to insider threats or scenarios where attacker has already compromised a Standard Registry account through separate means such as credential stuffing or phishing. Non-network deployments or air-gapped Guardian instances reduce but don't eliminate risk if malicious insiders have local access.

CVSS 8.7 (High) reflects the severe impact potential (VC:H/VI:H/VA:H) with authenticated network exploitation (AV:N/PR:L) requiring no user interaction. However, real-world risk signals show divergence: EPSS 0.12% (31st percentile) indicates very low probability of mass exploitation, SSVC classifies exploitation status as 'none' and automatable as 'no', and no CISA KEV listing exists. This discrepancy suggests the vulnerability requires specific deployment contexts - organizations must use the Custom Logic policy block feature and grant Standard Registry user roles, which may not be universally enabled. The authentication requirement (PR:L) significantly reduces attack surface versus unauthenticated RCE, but the 'total' technical impact rating in SSVC correctly identifies that successful exploitation yields complete container compromise including credential theft and horizontal privilege escalation via token forgery. Priority for patching should be HIGH for Guardian deployments actively using Custom Logic policies with multiple user roles, MEDIUM for single-admin deployments, and LOWER for installations not utilizing this feature. Critical gap: no confirmation whether exploitation requires non-default configuration of the Custom Logic block or if it's enabled by default in Guardian installations.

An authenticated Standard Registry user with legitimate access to Guardian's policy management interface creates a new Custom Logic policy block containing malicious JavaScript code. The payload uses require('fs') to read /proc/self/environ and extract JWT_SECRET and RSA_PRIVATE_KEY environment variables, then uses require('crypto') to forge a valid JWT token for an administrator account. The attacker authenticates as admin, gains full platform control, and exfiltrates all policy data and user credentials. No public POC exists at time of analysis, but exploitation complexity is low (AC:L) for users with policy creation permissions.