CVE-2026-26267
Function Call Resolution Bug in soroban-sdk Causes Security Bypass
Publication date: 2026-02-19
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| stellar | rs-soroban-sdk | to 22.0.10 (exc) |
| stellar | rs-soroban-sdk | From 23.0.0 (inc) to 23.5.2 (exc) |
| stellar | rs-soroban-sdk | From 25.0.0 (inc) to 25.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-670 | The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the soroban-sdk Rust SDK for Soroban contracts, specifically in the #[contractimpl] macro prior to versions 22.0.10, 23.5.2, and 25.1.1. The macro incorrectly generates code that calls inherent functions instead of trait functions when both have the same name. This happens because the macro uses MyContract::value() style calls even when processing trait implementations, causing the inherent function to be called instead of the intended trait function.
If the trait function includes important security checks (like verifying caller authorization) that the inherent function lacks, those checks are bypassed. As a result, anyone interacting with the contract's public interface may trigger the wrong function, potentially bypassing security controls.
The issue is fixed in soroban-sdk-macros versions 22.0.10, 23.5.2, and 25.1.1 by changing the generated calls to explicitly reference the trait function, ensuring correct resolution. Until upgrading, developers can avoid the problem by ensuring no inherent function shares a name with a trait function.
How can this vulnerability impact me? :
This vulnerability can lead to security checks being bypassed if the trait function contains authorization or other important validations that the inherent function does not. Consequently, unauthorized users might be able to invoke sensitive contract functions without proper verification.
Because the wrong function is called silently, contract behavior may deviate from expected security policies, potentially allowing malicious actors to exploit the contract, leading to integrity issues or unauthorized actions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should upgrade to soroban-sdk-macros versions 22.0.10, 23.5.2, or 25.1.1 and recompile their contracts.
If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation.
Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.