HackerOne Disclosed Reports - 2026-08-04

Critical
resolved

`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`

Bug reported by Beni Saprulah was disclosed at August 5, 2026, 5:05 am   |   Improper Access Control - Generic

The `relay_tx` wallet-RPC method in Monero was found to bypass the `--restricted-rpc` guard, allowing any caller to corrupt the wallet state by submitting a malicious `pending_tx` blob. The issue was that the `on_relay_tx` handler did not perform any ownership checks on the supplied `pending_tx` before passing it to `commit_tx`, which then updated the wallet state based on the attacker-controlled data. This vulnerability was introduced in the master branch and was present at the time of the commit analyzed.