CVE-2026-40583: Ultradag

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.

Affected products

• Ultradag Ultradag: version 0.1.0 only

Published 2026-04-21. Last modified 2026-06-17.