stellar rs-soroban-sdk up to 22.0.9/23.5.1/25.1.0 MyContract::value control flow

Summaryinfo

A vulnerability was found in stellar rs-soroban-sdk up to 22.0.9/23.5.1/25.1.0. It has been classified as critical. Impacted is the function MyContract::value. The manipulation leads to control flow. This vulnerability is uniquely identified as CVE-2026-26267. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in stellar rs-soroban-sdk up to 22.0.9/23.5.1/25.1.0. It has been rated as critical. This issue affects the function MyContract::value. The manipulation with an unknown input leads to a control flow vulnerability. Using CWE to declare the problem leads to CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it's processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function. This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously: First, an `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied. Second, an `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied. If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function. The problem is patched in `soroban-sdk-macros` versions 22.0.10, 23.5.2, and 25.1.1. The fix changes the generated call from `<Type>::func()` to `<Type as Trait>::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists. Users should upgrade to `soroban-sdk-macros` 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts. If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-26267 since 02/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 22.0.10, 23.5.2 or 25.1.1 eliminates this vulnerability. Applying the patch e92a3933e5f92dc09da3c740cf6a360d55709a2b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• stellar

Name

• rs-soroban-sdk

Version

• 22.0.0
• 22.0.1
• 22.0.2
• 22.0.3
• 22.0.4
• 22.0.5
• 22.0.6
• 22.0.7
• 22.0.8
• 22.0.9
• 23.5.0
• 23.5.1
• 25.0
• 25.1.0

License

• open-source

Website

• Product: https://github.com/stellar/rs-soroban-sdk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion