CVE-2026-62162
Received Received - Intake

Hydra Deposit UTxO Consumption Before Deadline in Version 2.1.0

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-62162
EUVD
EUVD-2026-114282

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cardano-scaling hydra < 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Hydra, a Cardano layer-two scalability solution, allows an attacker to steal deposited assets before a deadline. The issue occurs because the Claim branch in the deposit validator only checks if the attacker-controlled currency symbol matches the head ID and if the transaction is valid before the deadline. It does not require spending the Head state-token UTxO or constraining outputs, enabling third parties to consume pending deposits and redirect funds to arbitrary addresses.

Detection Guidance

This vulnerability affects Hydra nodes running versions prior to 2.1.0. To detect it, check the version of Hydra installed on your system using the command hydra-node --version. If the version is below 2.1.0, the system is vulnerable.

Impact Analysis

If you use Hydra prior to version 2.1.0, an attacker could steal funds from pending deposits before the deadline. This affects users who have committed assets via the POST /commit endpoint, as the vulnerability allows unauthorized redirection of those assets to attacker-controlled addresses.

Mitigation Strategies

Upgrade Hydra to version 2.1.0 or later immediately. This version includes the fix for the deposit validation issue. Follow the official Hydra documentation for upgrade instructions to ensure proper installation and configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart