# CVE-2026-104419: Zebra (zebrad) insufficient peer authentication in block synchronization

Source: https://junglewise.ai/threats/cve-2026-104419-zebra-zebrad-4-5-0-before-6-3-0-discards-which-peer-supplied-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104419 · Severity: medium · CVSS 4.8 · Published 2026-10-02

Zebra is a Zcash node implementation that synchronizes blockchain data across a peer network. A remote attacker can trick a syncing node into banning its honest peers by sending bogus far-ahead block hashes, causing the victim to lose trusted connections and become vulnerable to network isolation (eclipse attacks). This affects nodes that are significantly behind the blockchain tip, such as during initial sync or after an extended outage.

Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-104419 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104419 being exploited in the wild.

**How severe is CVE-2026-104419?** Medium severity, with a CVSS score of 4.8, published 2 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra (zebrad) 4.5.0 to 6.2.3.

**Is there a fix for CVE-2026-104419?** Yes: fixed in 6.3.0. Until then: Ensure your node is synchronized to or near the network tip, at which point the far-ahead height condition no longer applies. Operators running long catch-up synchronization on constrained peer sets should prioritize reaching sync to minimize eclipse exposure. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104419 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104419?** Check whether you run Zcash Foundation Zebra (zebrad) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.3.0

Ensure your node is synchronized to or near the network tip, at which point the far-ahead height condition no longer applies. Operators running long catch-up synchronization on constrained peer sets should prioritize reaching sync to minimize eclipse exposure.

## Technical details

The vulnerability stems from improper peer attribution in block discovery: FindBlocks responses lack source address information, so when far-ahead blocks are routed to other peers for retrieval, the sync layer cannot connect the block back to its originating peer. When a block arrives from height >50,000 above the tip, the serving peer (not the malicious responder) receives 100 misbehavior points—the ban threshold—despite correctly fulfilling a request. An attacker repeatedly exploits this to whittle down a victim's peer set and increase eclipse risk.

## Affected products

- Zcash Foundation Zebra (zebrad) 4.5.0 to 6.2.3

## Timeline

- 2026-08-11: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qhr3-cvch-5fh2](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qhr3-cvch-5fh2)
- [https://www.vulncheck.com/advisories/zebra-before-6.3.0-honest-peer-banning-via-far-ahead-findblocks-hashes](https://www.vulncheck.com/advisories/zebra-before-6.3.0-honest-peer-banning-via-far-ahead-findblocks-hashes)