Vulnerability · Published Sep 3, 2026 · Assigned by GitHub_M

CVE-2026-57445Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve

High 8.7

In plain English

A high-severity security flaw in gardens-v2 from 1Hive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches.

Affected products (as reported)

Vendor	Product	Versions
1Hive	gardens-v2	<= dfba919e218e20d52db9f7b2e8d292d45a46c91b

Weakness: CWE-703 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/1Hive/gardens-v2/security/advisories/GHSA-3xpr-2mm7-77j7 x_refsource_CONFIRM