CVE-2026-82751
Received Received - Intake

Gas Cost Inflation in ZenHive mpp

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: EEF

Description
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but does not check whether the envelope carries the optional key_authorization field. A client can attach a fully signed key authorization, provisioning a new access key with token spending limits on its own account, alongside the normal payment call. The key and each limit entry are persistent storage writes billed as intrinsic gas to the sponsor, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits the sponsored cost rises from about 46,587 gas to about 1,808,700 gas, and the client keeps a valid access key it paid nothing for. This issue affects mpp: from 0.2.0 before 0.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-08
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-82751
EUVD
EUVD-2026-72147

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zenhive mpp From 0.2.0 (inc) to 0.16.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82751 is an improper input validation flaw in ZenHive mpp's Tempo fee-payer sponsorship system. It allows an unauthenticated remote client to attach a fully signed key authorization to a transaction, provisioning a new access key on their own account with token spending limits. This inflates the fee payer's gas cost significantly, from ~46,587 to ~1,808,700 gas, while the client gains a valid access key at no cost.

Detection Guidance

Monitor gas usage spikes in Tempo fee-payer transactions. Check for unexpected access key provisioning events in transaction logs. Inspect MPP server logs for transactions with unusually high gas costs compared to baseline.

Impact Analysis

If you operate a ZenHive mpp server with Tempo fee sponsorship enabled, an attacker could exploit this to inflate your gas costs by up to 39 times per transaction. The attacker gains a valid access key to your Tempo account, enabling future unauthorized transactions at your expense. The vulnerability only affects deployments with Tempo server-side fee sponsorship enabled.

Compliance Impact

This vulnerability does not directly affect GDPR or HIPAA compliance as it involves financial transaction gas cost inflation and unauthorized access key provisioning in a blockchain payment system. However, if exploited, it could lead to financial losses for sponsors, which may indirectly impact data protection budgets or resource allocation for compliance efforts.

Mitigation Strategies
  • Upgrade mpp to version 0.16.1 or later to address the improper input validation.
  • Disable Tempo server-side fee sponsorship if not required for operations.
  • Set a lower max_gas override in fee_payer_policy to limit gas inflation potential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82751. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart