Executive brief
Anchor is a popular development framework used to build applications (programs) on the Solana blockchain. A logic error in the framework allows attackers to bypass security checks that ensure a program is interacting with the official Solana System Program. This could allow a malicious actor to trick an application into performing unauthorized actions, such as bypassing payments or redirecting funds, by substituting the legitimate system program with a different one.
Technical details
A logic error exists in the TryFrom implementation for Program<'a, T> within the anchor-lang library. When T is the System program, its ID (Pubkey::default()) is incorrectly treated the same as the default unit type (), which Anchor uses to signal that any executable account is acceptable. Consequently, the runtime fails to verify that the account passed as the System program is actually the official Solana System Program. An attacker can exploit this by passing an arbitrary program ID in place of the System program, leading to arbitrary Cross-Program Invocations (CPI) or payment bypassing in programs that rely on Anchor's automatic validation. This vulnerability is fixed in version 1.0.2.
Affected products
- Anchor (Solana Foundation) anchor-lang 1.0.0 to < 1.0.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE-2026-45137 published to NVD
- 2026-05-27: patched: Fix released in version 1.0.2