Vulnerability · Published Mar 5, 2026 · Assigned by GitHub_M
CVE-2026-28410The Graph: Revocable vesting contracts allows early access to locked tokens
Medium 5.3
In plain English
A medium-severity improper access control in contracts from graphprotocol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in version 3.0.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| graphprotocol | contracts | < 3.0.0 |
Weakness: CWE-284, CWE-682 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N