PT-2026-23505 · Graphprotocol · The Graph

Published 2026-03-05 · Updated 2026-03-10 · CVE-2026-28410

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The Graph versions prior to 3.0.0

Description A flaw exists in the token vesting contracts of The Graph protocol. This issue allows users to access tokens before they are released according to their vesting schedule. The problem was addressed with the release of version 3.0.0.

Recommendations Update to version 3.0.0 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-682

Related Identifiers

CVE-2026-28410

GHSA-QX35-RC5X-X39R

Affected Products

The Graph

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28410.json · Exploit
• https://github.com/graphprotocol/contracts/security/advisories/GHSA-qx35-rc5x-x39r · Vendor Advisory
• https://github.com/graphprotocol/contracts/commit/91224ed83eeff3fc3afea01f5ed269373d9bf773 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28410 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28410 · Vendor Advisory
• https://t.me/cveNotify/154931 · Telegram Post
• https://twitter.com/CVEnew/status/2030385214652879067 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029692160702910834 · Twitter Post