What is GHSA-vxx8-8p7v-9mvp?

GHSA-vxx8-8p7v-9mvp is a security advisory published by GitHub Security Advisories with Critical severity. MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of...

Which CVE IDs does GHSA-vxx8-8p7v-9mvp cover?

GHSA-vxx8-8p7v-9mvp covers the following CVE IDs: CVE-2026-106511. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vxx8-8p7v-9mvp?

GHSA-vxx8-8p7v-9mvp has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-vxx8-8p7v-9mvpCriticalCVSS 9.8

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of...

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-106511 →

📋 Description

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-106511
https://github.com/multiversx/mx-multisig-and-modules
https://gist.github.com/x01griax/c03f4be898dc55ccf3bab667c83c7312
https://github.com/advisories/GHSA-vxx8-8p7v-9mvp