CVE-2026-45137: Anchor Framework improper validation of System Program ID

CVE-2026-45137 · Severity: high · CVSS 8.2 · Published 2026-05-27

Anchor is a popular development framework used to build applications (programs) on the Solana blockchain. A logic error in the framework allows attackers to bypass security checks that ensure a program is interacting with the official Solana System Program. This could allow a malicious actor to trick an application into performing unauthorized actions, such as bypassing payments or redirecting funds, by substituting the legitimate system program with a different one.

Technologies: anchor-lang (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-45137 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45137 being exploited in the wild.
How severe is CVE-2026-45137?
High severity, with a CVSS score of 8.2, published 27 May 2026.
Which products and versions are affected?
anchor-lang (crates.io) >= 1.0.0, < 1.0.2, SEMVER:introduced=1.0.0,fixed=1.0.2; Solana Foundation Anchor >= 1.0.0, < 1.0.2, 1.0.0 to < 1.0.2.
Is there a fix for CVE-2026-45137?
Yes. anchor-lang (crates.io): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45137 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45137?
Check whether you run anchor-lang (crates.io) or Solana Foundation Anchor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • anchor-lang (crates.io): upgrade to 1.0.2 or later
    cargo update -p anchor-lang

Technical details

A logic error exists in the TryFrom implementation for Program<'a, T> within the anchor-lang library. When T is the System program, its ID (Pubkey::default()) is incorrectly treated the same as the default unit type (), which Anchor uses to signal that any executable account is acceptable. Consequently, the runtime fails to verify that the account passed as the System program is actually the official Solana System Program. An attacker can exploit this by passing an arbitrary program ID in place of the System program, leading to arbitrary Cross-Program Invocations (CPI) or payment bypassing in programs that rely on Anchor's automatic validation. This vulnerability is fixed in version 1.0.2.

Affected products

  • Anchor (Solana Foundation) anchor-lang 1.0.0 to < 1.0.2

Identifiers

  • CVE-2026-45137
  • GHSA-c6rc-8jpp-2fgc
  • RUSTSEC-2026-0144

Timeline

  • 2026-05-07: advisory: GitHub Security Advisory published
  • 2026-05-27: disclosed: CVE-2026-45137 published to NVD
  • 2026-05-27: patched: Fix released in version 1.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.