EUVD-2026-72876
GHSA-wm9v-x9j6-gf6x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires a signed on-chain account so PR:L not PR:N; impact is forged commission attribution (integrity/financial), so I:H with C:N and A:N.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
5DescriptionCVE.org
The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channel_id when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
AnalysisAI
Improper authorization in Bifrost's vtoken-minting and slpx Substrate pallets lets any signed on-chain account attribute its mint volume to an arbitrary registered channel_id it does not control. Because the mint path never verifies that the caller is authorized to mint on behalf of the supplied channel, an attacker can inflate a target (or attacker-owned) channel's recorded mint volume and skew protocol commission settlement so payouts are disproportionately routed to that channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a signed Bifrost account able to submit mint transactions to the vtoken-minting or slpx pallet, and at least one registered channel_id to attribute volume to (attacker-controlled or otherwise). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) overstates the profile in two ways. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data - the EUVD entry gives only an affected range ('≤2022.02') and no fixed spec/runtime version, so operators and integrators should track the Bifrost security channel and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-86840) for the corrective runtime upgrade and apply it via on-chain governance/runtime-upgrade as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit recent vtoken-minting and slpx pallet transactions for suspicious channel_id registrations, query blockchain logs for anomalous minting patterns or newly-registered channels receiving disproportionate commission shares, and quantify total financial exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Rated mediu
Unauthenticated remote code execution in Maxim AI's Bifrost LLM gateway (transports v2.0.0 and earlier) allows any netwo
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other se
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins)
Share
External POC / Exploit Code
Leaving vuln.today