EUVD-2026-21146
GHSA-49xc-52mp-cc9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessMalicious validator creates block with future timestamp
-
ExploitBypass upper bound validation check
-
ExecutionManipulate reward calculation via Policy::supply_at()
-
ImpactInflate monetary supply beyond intended emission
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | Attacker must be a block-producing validator on the Nimiq blockchain network running nimiq-blockchain 1.3.0 or earlier. Attacker can exploit this without victim interaction by creating malicious blocks with arbitrarily future timestamps to inflate monetary supply through reward calculation manipulation. |
| Impact | High-severity logic flaw enables authenticated validators to arbitrarily inflate future block timestamps, directly corrupting reward calculations and monetary supply issuance. CVSS 8.1 reflects high integrity/availability impact. No upper-bound validation creates persistent, deterministic supply inflation. Requires validator-level authentication but affects protocol consensus guarantees and economic model integrity across entire blockchain. |
| Exploit ScenarioDerived | Authenticated validator crafts block with timestamp years in future. Timestamp passes parent-relative validation (no upper bound check). Policy::supply_at() and batch_delay() process inflated timestamp, returning excessive rewards. Attacker accumulates disproportionate block rewards and distorts emission schedule permanently. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Timestamp manipulation in Nimiq Core Rust implementation (nimiq-blockchain 1.3.0 and earlier) allows authenticated block-producing validators to set arbitrarily future block timestamps, bypassing validation constraints and directly inflating the blockchain's monetary supply beyond the intended emission schedule through compromised Policy::supply_at() and batch_delay() reward calculations. The vulnerability exploits absent upper-bound wall-clock validation in non-skip and skip block timestamp verification logic, enabling integrity compromise of the blockchain's economic model. No public exploit identified at time of analysis.
RemediationAI
Vendor-released security advisory available at https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j. Upgrade to patched version specified in GitHub advisory immediately. No patched version number independently confirmed in available data; consult vendor advisory for exact fixed release. As interim mitigation, restrict block-producing validator privileges to trusted entities only and implement monitoring for abnormal timestamp deltas between consecutive blocks exceeding expected network drift thresholds. Organizations running validator nodes should audit historical block timestamps for anomalies indicative of prior exploitation and validate total supply calculations against canonical emission schedule. No effective workaround exists without source-level validation enforcement; deployment of vendor patch is mandatory for production blockchain networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in cargo, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-1284 (improper input validation) in block timestamp validation logic. Validation enforces timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but omits maximum bound checking against system wall clock. Malicious validators exploit this to inject future-dated timestamps, poisoning reward computation functions in blockchain/src/reward.rs module.
Know when Core Rs Albatross gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
Executive ViewAI
CVE-2026-40093 affects Nimiq Core Rust implementation (versions 1.3.0 and earlier) and allows authenticated validators to manipulate block timestamps, directly enabling unauthorized cryptocurrency supply inflation beyond protocol limits. Organizations operating Nimiq blockchain validators or dependent on accurate token economics face potential loss of monetary policy integrity and token value degradation if compromised validators are exploited.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or remove affected validators from consensus participation until patched; (2) Implement external policy enforcement layer to reject blocks with timestamps exceeding current time + configurable maximum skew; (3) Monitor block timestamps in real-time for anomalies exceeding normal network skew; (4) Restrict validator key access to offline/HSM-protected storage to prevent credential compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Core Rs Albatross
View allInteger truncation in Nimiq core-rs-albatross's skip block proof verification allows authenticated validators to forge c
Nimiq core-rs-albatross validators prior to version 1.3.0 can be remotely crashed via malformed Tendermint proposals. An
Integer underflow in Nimiq core-rs-albatross <1.3.0 enables unauthenticated remote attackers to trigger deterministic de
Denial of service in Nimiq Core RS Albatross prior to version 1.3.0 allows remote attackers to crash full nodes by sendi
Elected validator proposers in nimiq/core-rs-albatross before version 1.3.0 can submit election macro blocks with malfor
Panic-triggered denial of service in Nimiq's core-rs-albatross (versions prior to 1.4.0) allows a network-level attacker
Exploit-DB