PT-2026-34555 · Unknown · Nimiq-Transaction

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-34068

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions nimiq-transaction versions prior to 1.3.0

Description The staking contract accepts UpdateValidator transactions that set new voting key=Some(...) while omitting new proof of knowledge. This bypasses the proof-of-knowledge requirement necessary to prevent BLS rogue-key attacks during public key aggregation. Since tendermint macro block justification verification aggregates validator voting keys and verifies a single aggregated BLS signature against that aggregate public key, a rogue-key voting key in the validator set could allow an attacker to forge a quorum-looking justification using only a single signature. Exploitability is low because voting keys are fixed for the epoch, requiring the attacker to know the next epoch validator set chosen through VRF (Verifiable Random Function).

Recommendations Update to version 1.3.0.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-34068

GHSA-PF4J-PF3W-95F9

Affected Products

Nimiq-Transaction

References · 8

• https://github.com/nimiq/core-rs-albatross/pull/3654 · Patch
• https://github.com/nimiq/core-rs-albatross/commit/e7f0ab7d2115e17d6e5548ddc60f10df1a5d645f · Patch
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-pf4j-pf3w-95f9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pf4j-pf3w-95f9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34068 · Security Note
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://twitter.com/CVEnew/status/2047359952566604040 · Twitter Post