CVE-2026-26267
📋 TL;DR
This vulnerability in soroban-sdk allows attackers to bypass security checks in Soroban smart contracts when trait and inherent functions share the same name. The bug causes the wrong function to be called, potentially skipping authorization and validation logic. All developers using affected versions of soroban-sdk for Soroban contract development are impacted.
💻 Affected Systems
- soroban-sdk
- soroban-sdk-macros
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete contract compromise allowing unauthorized access to all contract functions and funds, bypassing all security controls.
Likely Case
Authorization bypass allowing unauthorized users to execute privileged contract functions they shouldn't have access to.
If Mitigated
No impact if contracts don't have conflicting function names between trait and inherent implementations.
🎯 Exploit Status
Exploitation requires identifying contracts with the specific function naming pattern and calling the vulnerable functions. No authentication needed as smart contracts are publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: soroban-sdk-macros 22.0.10, 23.5.2, or 25.1.1
Vendor Advisory: https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254
Restart Required: No
Instructions:
1. Update soroban-sdk-macros dependency to 22.0.10, 23.5.2, or 25.1.1. 2. Recompile all contracts. 3. Redeploy updated contracts to blockchain.
🔧 Temporary Workarounds
Function Renaming
allRename or remove inherent functions that conflict with trait function names to eliminate the ambiguity.
Manual code review and modification of contract source code
🧯 If You Can't Patch
- Audit all contracts for function naming conflicts between trait and inherent implementations
- Consider pausing or disabling affected contracts until they can be recompiled with the fix
🔍 How to Verify
Check if Vulnerable:
Check Cargo.toml for soroban-sdk-macros version below 22.0.10, 23.5.2, or 25.1.1, and review contract code for trait/inherent function name conflicts.Check Version:
grep soroban-sdk-macros Cargo.toml && grep soroban-sdk-macros Cargo.lockVerify Fix Applied:
Verify soroban-sdk-macros version is 22.0.10, 23.5.2, or 25.1.1 in Cargo.lock, and contracts have been recompiled with updated dependency.📡 Detection & Monitoring
Log Indicators:
- Unexpected contract function calls
- Authorization failures in contract logs
Network Indicators:
- Unusual transaction patterns to contract functions that should be restricted
SIEM Query:
Not applicable - blockchain transactions are logged on-chain rather than traditional SIEM systems🔗 References
- https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b
- https://github.com/stellar/rs-soroban-sdk/pull/1729
- https://github.com/stellar/rs-soroban-sdk/pull/1730
- https://github.com/stellar/rs-soroban-sdk/pull/1731
- https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254
