resolved
Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
Bug reported by Griffin was disclosed at August 5, 2026, 3:50 pm | Code Injection
A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the exposure of sensitive information such as database credentials, deployment access tokens, and encryption keys.
resolved
`check_reserve_proof` counts duplicate entries: one output can inflate `total`
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 10:23 am | Business Logic Errors
A vulnerability was discovered in the `check_reserve_proof` function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue was in the verifier logic, where the accounting was done in a flat manner, adding the output amount for each row without checking for duplicates.
resolved
`check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 10:23 am | Missing Required Cryptographic Step
The `check_reserve_proof` function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actually exist on-chain.
resolved
wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 10:23 am | NULL Pointer Dereference
A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were not always valid, leading to undefined behavior when attempting to access empty data structures. The crash occurred when the wallet software tried to retrieve metadata from the empty response, causing a segmentation fault.
resolved
SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 10:23 am | Missing Required Cryptographic Step
A vulnerability was discovered in the Monero project where the get_spend_proof and check_spend_proof functions do not verify the returned transaction hash against the requested transaction ID. This allows a malicious or compromised daemon to provide a valid serialized transaction body for a different transaction than the one requested, which can be used to create or verify a spend proof for that different transaction.
resolved
wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 10:23 am | Array Index Underflow
The wallet-rpc method "describe_transfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "real_output" index, which represents the position of the real entry in the ring, it used the "real_output_in_tx_index", which represents the position of the output in the source transaction. This resulted in the pre-sign review displaying the wrong information about the ring members to the cold-wallet operator. The signing process itself was not affected, as the correct ring members were used when constructing the transaction. The vulnerability was present in the master branch and the release-v0.18 branch of the monero-project/monero repository.
resolved
`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`
Bug reported by Beni Saprulah was disclosed at August 5, 2026, 5:05 am | Improper Access Control - Generic
The `relay_tx` wallet-RPC method in Monero was found to bypass the `--restricted-rpc` guard, allowing any caller to corrupt the wallet state by submitting a malicious `pending_tx` blob. The issue was that the `on_relay_tx` handler did not perform any ownership checks on the supplied `pending_tx` before passing it to `commit_tx`, which then updated the wallet state based on the attacker-controlled data. This vulnerability was introduced in the master branch and was present at the time of the commit analyzed.