CVE-2026-59695— mpp Tempo 未限制 max_fee_per_gas 导致单请求钱包耗尽漏洞
可能的 ATT&CK 技术 1AI
T1190 · Exploit Public-Facing Application获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-59695 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer (fee_payer: true), MPP.Tempo.Transaction.cosign_fee_payer/3 re-signs the client-supplied base fields of the 0x76 AASigned envelope verbatim, including max_fee_per_gas and max_priority_fee_per_gas, without validating that they are within reasonable bounds. A malicious client embeds arbitrarily large values for these fields in the signed envelope. The server co-signs and broadcasts the transaction. The effective_gas_price billed against the fee-payer wallet is derived from the attacker-supplied ceilings, so the server pays those inflated per-gas rates out of its own wallet. A single crafted request can drain the wallet entirely, after which the server can no longer sponsor gas for legitimate payment requests. This issue affects mpp: from 0.2.0 before 0.6.0.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
CWE-1284
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-59695 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-59695 的情报信息
请登录查看更多情报信息。
CVE-2026-59695 厂商安全公告 (3)
- 🔗 EEF-CVE-2026-59695 - OSVrelated
同批安全公告 · ZenHive · 2026-07-17 · 共 3 条
| CVE-2026-59694 | MPP Tempo 费用支付者非受限访问列表导致gas费用膨胀 | |
| CVE-2026-59252 | MPP Tempo 缺少 gas_limit 验证导致钱包被盗 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-59695
暂无评论