ZenHive mpp CVE-2026-73541

Exploitation requires that the target mpp deployment is configured with fee_payer_url to enable hosted fee-payer sponsorship (the Tempo pipeline with the fee_payer_policy block active). This is not a default condition - an operator must explicitly enable and configure sponsored transactions. Once that feature is enabled, exploitation requires no authentication (PR:N per the CVSS vector) and no user interaction; the attacker needs only network access to the sponsored-transaction endpoint and the ability to generate multiple distinct signed transactions (distinct hashes, distinct nonces) within the 900-second validity window. Exploitation is limited to deployments using mpp 0.2.0 through 0.11.x with hosted sponsorship enabled; mpp deployments that do not use the fee_payer_url sponsorship feature are not affected. There is no constraint on the attacker's transaction content beyond validity under the per-transaction fee policy.

The CVSS 4.0 score of 8.3 is well-founded and not inflated. The vector AV:N/AC:L/AT:P/PR:N/UI:N reflects that exploitation is network-accessible, requires no privileges, and involves no user interaction, but the AT:P attack requirement correctly captures that the sponsor feature must be configured and active - this is not a default-on condition for arbitrary mpp deployments. Integrity (VI:H) and availability (VA:H) impacts are both severe: a drained fee-payer wallet simultaneously destroys the financial integrity of the sponsorship service and denies legitimate users access to sponsored transactions for the duration of the 900-second validity window per wave of attack transactions. There is no confidentiality impact. No EPSS data or KEV listing was present in the input, meaning this is not confirmed as actively exploited by CISA. The attack is low-complexity once the sponsor endpoint is reachable, making it a genuine priority for any deployment using mpp's hosted sponsorship functionality, despite the absence of public exploit code.

An attacker discovers a public-facing mpp-powered API endpoint configured for hosted fee-payer sponsorship, such as a DeFi relay or gas-abstraction service. The attacker submits hundreds of concurrent sponsored transaction requests, each with a distinct nonce, all valid under the per-transaction fee policy ceiling - each is individually accepted and committed against the sponsor wallet. Within the 900-second validity window, the cumulative committed exposure exceeds the wallet balance, causing the sponsor to become unable to fund legitimate transactions until the in-flight commitments expire. No public exploit code is known at time of analysis, but the attack requires only the ability to generate distinct signed transactions and issue concurrent HTTP requests.