# CVE-2026-34061: Nimiq core-rs-albatross interlink verification bypass in election macro blocks

Source: https://junglewise.ai/threats/cve-2026-34061-nimiq-core-rs-albatross-interlink-verification-bypass-in-election  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34061 · Severity: medium · CVSS 4.9 · Published 2026-04-03

Nimiq core-rs-albatross is a Rust implementation of the Nimiq blockchain protocol. A vulnerability allowed a malicious network validator to propose a specially crafted block that bypasses certain security checks. This could lead to a situation where the blockchain network reaches a consensus on a block that it later rejects, potentially causing a denial of service or disrupting the stability of the blockchain.

Technologies: [Nimiq Albatross](https://junglewise.ai/threats/technologies/albatross), [Nimiq Proof-Of-Stake](https://junglewise.ai/threats/technologies/nimiq-proof-of-stake). Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-34061 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34061 being exploited in the wild.

**How severe is CVE-2026-34061?** Medium severity, with a CVSS score of 4.9, published 3 April 2026.

**Which products and versions are affected?** Nimiq Albatross < 1.3.0.

**Is there a fix for CVE-2026-34061?** A patch was published on 2026-03-27: Fix committed and version 1.3.0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34061 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34061?** Check whether you run Nimiq Albatross or Nimiq Proof-Of-Stake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the Nimiq core-rs-albatross implementation of the Albatross consensus protocol allows an elected validator proposer to submit an election macro block with a malformed 'header.interlink'. The 'verify_macro_block_proposal()' function fails to validate the interlink binding for election blocks, even though it checks other header properties. While the block is accepted during the Tendermint proposal phase, it is subsequently rejected with an 'InvalidInterlink' error during the 'verify_block()' push phase. Because validators have already prevoted and precommitted the malformed header hash, the failure occurs after the block is finalized, leading to a consensus disruption. This issue is fixed in version 1.3.0 by extracting the interlink check into a shared verification path.

## Affected products

- Nimiq core-rs-albatross < 1.3.0

## Timeline

- 2026-03-27: patched: Fix committed and version 1.3.0 released.
- 2026-04-03: disclosed: Advisory published.

## References

- [https://github.com/nimiq/core-rs-albatross/commit/9d7d17c9163384e79f61cdbbfe9853ae57bb8bf7](https://github.com/nimiq/core-rs-albatross/commit/9d7d17c9163384e79f61cdbbfe9853ae57bb8bf7)
- [https://github.com/nimiq/core-rs-albatross/pull/3668](https://github.com/nimiq/core-rs-albatross/pull/3668)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gr83-j5f8-p2r5](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gr83-j5f8-p2r5)

## Related threats

- [Nimiq Albatross denial of service in MerkleRadixTrie synchronization](https://junglewise.ai/threats/cve-2026-46545-nimiq-albatross-denial-of-service-in-merkleradixtrie)
- [Nimiq core-rs-albatross DHT query poisoning in handle_dht_get](https://junglewise.ai/threats/cve-2026-46541-nimiq-core-rs-albatross-dht-query-poisoning-in-handle-dht-get)
- [Nimiq Albatross state synchronization failure in LightBlockchain rebranch](https://junglewise.ai/threats/cve-2026-46540-nimiq-albatross-state-synchronization-failure-in-lightblockchain)
- [Nimiq core-rs-albatross denial of service in DHT record handling](https://junglewise.ai/threats/cve-2026-44505-nimiq-core-rs-albatross-denial-of-service-in-dht-record-handling)
- [nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge](https://junglewise.ai/threats/cve-2026-34068-nimiq-transaction-updatevalidator-transactions-allows-voting-key)