Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M

CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

Medium 5.9

In plain English

A medium-severity insufficient verification of data authenticity in core-rs-albatross from nimiq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.1%top 95.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification. This issue has been patched in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
nimiq	core-rs-albatross	< 1.4.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c x_refsource_CONFIRM
https://github.com/nimiq/core-rs-albatross/pull/3705 x_refsource_MISC
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 x_refsource_MISC