CVE-2026-26267VulnerabilityPublished 19 Feb 2026

CVE-2026-26267: stellar rs-soroban-sdk · Always-Incorrect Control Flow Implementation

Affects stellar rs-soroban-sdkSource CVE Database V5

Not known to be exploited · CVSS 7.5 High · fixed in 25.1.1 : patch stellar rs-soroban-sdk soon.

Data as of 26 Oct 2026, 07:57 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 25.1.1, 23.5.2, 22.0.10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade stellar rs-soroban-sdk to 25.1.1, 23.5.2 or 22.0.10.

Affected software

Product	Affected	Fixed in
stellarrs-soroban-sdk	Affected >=25.0.0 <25.1.1 >=23.0.0 <23.5.2 <22.0.10	Fixed in 25.1.1 23.5.2 22.0.10

AI-suggested

1. Upgrade the soroban-sdk-macros package to version 22.0.10, 23.5.2, or 25.1.1 or later, and recompile all Soroban contracts to ensure the macro generates correct trait function calls. 2. If immediate upgrading is not feasible, audit all contracts for naming conflicts between inherent functions and trait functions; rename or remove any inherent functions that share names with trait functions to prevent ambiguous resolution. 3. Implement thorough code reviews focusing on function naming and macro usage to avoid similar issues in future contract development. 4. Employ automated static analysis tools to detect conflicting function names in contract codebases. 5. Monitor deployed contracts for anomalous behavior that could indicate exploitation of this vulnerability. 6. Educate developers on the importance of understanding Rust trait vs inherent function resolution semantics, especially in macro-generated code. 7. Consider adding runtime checks or additional authorization layers outside the vulnerable macro-generated code as a defense-in-depth measure until all contracts are patched.

Description

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it's processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function. This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously: First, an `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied. Second, an `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied. If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function. The problem is patched in `soroban-sdk-macros` versions 22.0.10, 23.5.2, and 25.1.1. The fix changes the generated call from `<Type>::func()` to `<Type as Trait>::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists. Users should upgrade to `soroban-sdk-macros` 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts. If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.

Impact

This vulnerability undermines the integrity of Soroban smart contracts by causing them to execute unintended code paths that bypass critical security checks. Specifically, if the trait implementation includes authorization or validation logic that the inherent function lacks, attackers can interact with the contract's public interface to invoke insecure functions, potentially leading to unauthorized actions such as fund transfers or state changes. Since the vulnerability affects the core SDK used to build contracts on the Stellar blockchain, any contract compiled with vulnerable versions is at risk. This could erode trust in the affected contracts and the broader Stellar ecosystem. The vulnerability does not directly impact confidentiality or availability but poses a high risk to contract integrity and authorization enforcement. Given the ease of exploitation (no privileges or user interaction required) and the silent nature of the failure, attackers could exploit this flaw without detection. Organizations relying on Soroban smart contracts for financial or critical operations face significant risk of unauthorized transactions or logic bypasses until patched.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Feb 2026, 21:47 UTC

WeaknessesCWE-670

Technical details

References

Community reviews

Related threats