CVE-2026-62162 Details
Description
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
A vulnerability in the Hydra layer-two scalability solution for Cardano, specifically in the deposit validator of the Hydra Plutus component, has been identified. This issue affects versions prior to 2.1.0. The vulnerability arises because the 'Claim' branch of the deposit validator only verifies that the 'datum.head_id' matches the attacker-controlled 'redeemer.currencySymbol' and that the transaction is valid before the deposit deadline. It does not require the Head state-token UTxO to be spent in the same transaction or impose any constraints on the outputs. As a result, any third party capable of constructing a Cardano transaction can intercept and consume a pending deposit UTxO before its deadline, redirecting the funds to an arbitrary address. This exploitation can be carried out without involving the Head validator, which bypasses essential safety checks. The default deposit deadline is three times the deposit period, allowing for a window of opportunity to exploit pending deposits before they expire.
Users should upgrade to Hydra version 2.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0 | [email protected] | Source CodeVendor |
| https://github.com/cardano-scaling/hydra/releases/tag/2.1.0 | [email protected] | Release NotesVendor |
| https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cardano Hydra | <= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |