PT-2026-33634 · Ultradag · Ultradag

Sumitshah00 · Published 2026-04-19 · Updated 2026-04-27 · CVE-2026-40583

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/U:Red

Name of the Vulnerable Software and Affected Versions UltraDAG version 0.1

Description A non-council attacker can submit a signed 'SmartOp::Vote' transaction that successfully passes signature, nonce, and balance prechecks. However, the authorization check fails only after state mutation has already occurred, potentially allowing unauthorized state changes.

Recommendations Update UltraDAG to a version where authorization checks for 'SmartOp::Vote' transactions are performed before state mutation.

Exploit

Fix

Weakness Enumeration

CWE-460

CWE-696

Related Identifiers

CVE-2026-40583

Affected Products

Ultradag

References · 7

• 🔥 https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp · Exploit
• https://github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511 · Patch
• https://github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40583 · Security Note
• https://twitter.com/RealHackSage/status/2045773594270302241 · Twitter Post
• https://twitter.com/CVEnew/status/2048910160014541062 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048911656718156177 · Twitter Post