Cardano Hydra EUVD-2026-114282

Exploitation requires a pending deposit UTxO created through the hydra-node POST /commit endpoint to be confirmed on-chain and not yet past its deadline (the default deadline is three times depositPeriod, typically tens of minutes to hours). The attacker needs only the ability to observe the Cardano chain and build/submit a standard Cardano transaction carrying a Claim redeemer with the head's currencySymbol - no Head involvement, no credentials, and no victim interaction. Limiting factors: the attack window closes at the deposit deadline, a deposit must actually be in-flight to steal, and the issue affects Hydra versions prior to 2.1.0; it works against default configurations, so no special non-default setting is required.

This is a genuine high-priority, theft-of-funds flaw rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, base 8.2, High) describes an unauthenticated, network-reachable attack whose only real gate is AT:P - a pending deposit UTxO must exist and the attacker must act before its deadline. VI:H with VC:N/VA:N correctly models the impact as unauthorized redirection of assets (integrity) rather than disclosure or service loss. The vuln.today decision label is 'this_week', consistent with a serious but not CISA-KEV-confirmed issue. No EPSS score and no KEV entry were provided in the input, so there is no evidence of active, widespread exploitation; however, the GitHub Security Advisory (GHSA-gfpc-m687-p7h5) includes a complete, step-by-step reproduction recipe, so a public PoC reference exists even though it is not packaged as a verified working exploit binary. Weighing the signals: the flaw is trivially exploitable in principle (the redeemer's currencySymbol is attacker-controlled, so the only head-id check is self-satisfied, and no Head validator runs), the economic motive is direct (draining deposited ADA), but real-world exposure is bounded by the small deployment footprint of Hydra heads and by the requirement that a deposit be in-flight before its deadline. One data conflict must be flagged: the description and release tag state the fix is version 2.1.0, while the embedded source-code evidence line reads 'Package: /hydra-node - vulnerable: <=2.0.0 - fixed in: not yet patched' - verify the actual patched release with the vendor.

Alice drafts a deposit via POST /commit, locking ADA in the deposit script with an inline datum (head_id H, deadline T). Mallory, watching the chain, submits a standalone transaction that spends Alice's deposit UTxO with a Claim(H) redeemer and outputs the value to her own address, with validity set before deadline T; no Head validator runs, so the transaction validates and Mallory drains the funds. A detailed reproduction/PoC walkthrough is published in the GHSA advisory, though it is not verified as packaged working exploit code.