PT-2026-20342 · Unknown · Soroban-Sdk-Macros

Nan-Zellic · Published 2026-02-17 · Updated 2026-02-19 · CVE-2026-26267

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions soroban-sdk-macros versions prior to 22.0.10 soroban-sdk-macros versions prior to 23.5.2 soroban-sdk-macros versions prior to 25.1.1

Description The #[contractimpl] macro in soroban-sdk-macros has a flaw in how it manages function calls. When processing trait implementations, the macro generates code that uses an incorrect call style, potentially invoking inherent functions instead of the intended trait functions if identically named functions exist in both inherent and trait implementations. This can lead to security checks within the trait implementation being bypassed, allowing unauthorized access or execution. The issue arises when a impl Trait for MyContract block with #[contractimpl] is defined alongside a impl MyContract block containing identically named functions without #[contractimpl]. The fix involves changing the generated call from <Type>::func() to <Type as Trait>::func(), ensuring the correct trait function is called.

Recommendations Upgrade to soroban-sdk-macros version 22.0.10 or later. Upgrade to soroban-sdk-macros version 23.5.2 or later. Upgrade to soroban-sdk-macros version 25.1.1 or later and recompile your contracts. If upgrading is not immediately possible, ensure that no inherent associated function on the contract type shares a name with any function in the trait implementation.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-26267

GHSA-4CHV-4C6W-W254

Affected Products

Soroban-Sdk-Macros

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26267.json · Exploit
• https://github.com/stellar/rs-soroban-sdk/pull/1731 · Patch
• https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b · Patch
• https://github.com/stellar/rs-soroban-sdk/pull/1730 · Patch
• https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254 · Vendor Advisory
• https://github.com/stellar/rs-soroban-sdk/pull/1729 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26267 · Security Note
• https://osv.dev/vulnerability/GHSA-4chv-4c6w-w254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26267 · Vendor Advisory
• https://github.com/stellar/rs-soroban-sdk · Note