nimiq core-rs-albatross up to 1.2.1 header.body_root integrity check

Summaryinfo

A vulnerability labeled as problematic has been found in nimiq core-rs-albatross up to 1.2.1. Impacted is an unknown function. Executing a manipulation of the argument header.body_root can lead to integrity check. This vulnerability is tracked as CVE-2026-28402. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in nimiq core-rs-albatross up to 1.2.1 and classified as problematic. This vulnerability affects an unknown part. The manipulation of the argument header.body_root with an unknown input leads to a integrity check vulnerability. The CWE definition for the vulnerability is CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. As an impact it is known to affect integrity, and availability. CVE summarizes:

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.2.2, a malicious or compromised validator that is elected as proposer can publish a macro block proposal where `header.body_root` does not match the actual macro body hash. The proposal can pass proposal verification because the macro proposal verification path validates the header but does not validate the binding `body_root == hash(body)`; later code expects this binding and may panic on mismatch, crashing validators. Note that the impact is only for validator nodes. The patch for this vulnerability is formally released as part of v1.2.2. The patch adds the corresponding body root verification in the proposal checks. No known workarounds are available.

The weakness was disclosed by Albatross. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-28402 since 02/27/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.2.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9074). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• nimiq

Name

• core-rs-albatross

Version

• 1.2.0
• 1.2.1

Website

• Product: https://github.com/nimiq/core-rs-albatross/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion