Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-19 | 2 | Disclosure1PoC1 |
| 2026-04-27 | 2 | Disclosure1General1 |
How I Crashed a Blockchain Node with a Single Vote (CVE-2026–40583) https://medium.com/@sumitshahorg/how-i-crashed-a-blockchain-node-with-a-single-vote-cve-2026-40583-b6dc61d44033?source=rss------bug_bounty-5 #bugbounty #bugbountytips #bugbountytip
Post summary
The text only references a Medium article announcing CVE‑2026‑40583, with no explicit PoC, exploitation details, patches, or evidence of active attacks.
CVE-2026-40583 UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, a… https://www.cve.org/CVERecord?id=CVE-2026-40583
Post summary
The text briefly outlines a vulnerability in UltraDAG’s SmartOp::Vote handling, but does not detail exploits, patches, or active attacks.
🔥 Just dropped a new case study! How I crashed a Layer 1 blockchain node with a single vote. Total impact: Critical | Bounty: 15,000 on chain coin | CVE: CVE-2026-40583 https://medium.com/@sumitshahorg/how-i-crashed-a-blockchain-node-with-a-single-vote-cve-2026-40583-b6dc61d44033 #CyberSecurity #BugBounty #Web3 https://t.co/fmuLEcDO3R
Post summary
The post reveals CVE-2026-40583 and details a proof‑of‑concept crash of a Layer 1 blockchain node via a single vote, but lacks evidence of active exploitation, a formal patch, or a dedicated exploit tool.
🚨*CVE* CVE-2026-40583 UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, a… https://www.cve.org/CVERecord?id=CVE-2026-40583 ----- Traducción: CVE-2026-40583 Ult… http://infoflow.cloud`
Post summary
The entry announces CVE‑2026‑40583 against UltraDAG, noting an authorization flaw that lets attackers submit valid vote transactions, but it contains no sign of active exploitation, patching, or a PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ultradag | ultradag | 0.1.0 | - | - |