# CVE-2026-59695: ZenHive mpp improper input validation in Tempo fee-payer

Source: https://junglewise.ai/threats/cve-2026-59695-zenhive-mpp-improper-input-validation-in-tempo-fee-payer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-59695 · Severity: info · CVSS 8.3 · Published 2026-07-17

ZenHive mpp is an Elixir library used for processing blockchain transactions. A vulnerability exists where the library fails to check the gas price requested by users when the server is configured to pay transaction fees. An attacker can send a single request with an extremely high gas price, causing the server to pay massive fees and potentially draining its entire digital wallet, which leads to financial loss and prevents legitimate users from making payments.

Technologies: [ZenHive Mpp](https://junglewise.ai/threats/technologies/mpp). Vendors: [ZenHive](https://junglewise.ai/threats/vendors/zenhive).

## Quick answers

**Is CVE-2026-59695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59695 being exploited in the wild.

**How severe is CVE-2026-59695?** Informational severity, with a CVSS score of 8.3, published 17 July 2026.

**Which products and versions are affected?** ZenHive Mpp from 0.2.0 before 0.6.0.

**Is there a fix for CVE-2026-59695?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59695?** Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is caused by improper validation of specified quantities (CWE-1284) in the MPP.Tempo.Transaction.cosign_fee_payer/3 function. When the library is configured with fee_payer: true, it re-signs client-supplied fields of the 0x76 AASigned envelope verbatim. An attacker can provide arbitrarily high values for max_fee_per_gas and max_priority_fee_per_gas, which the server then co-signs and broadcasts. This results in the server paying inflated per-gas rates from its own wallet. The issue is fixed in version 0.6.0.

## Affected products

- ZenHive mpp from 0.2.0 before 0.6.0

## Timeline

- 2026-06-24: advisory: Initial GitHub security advisory published
- 2026-07-17: disclosed: CVE-2026-59695 published to NVD

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-59695.html](https://cna.erlef.org/cves/CVE-2026-59695.html)
- [https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8](https://github.com/ZenHive/mpp/commit/5d6338e2334084c5f2a78cfcca474830733ed7e8)
- [https://github.com/ZenHive/mpp/security/advisories/GHSA-vv77-66rf-pm86](https://github.com/ZenHive/mpp/security/advisories/GHSA-vv77-66rf-pm86)

## Related threats

- [mpp gas limit validation failure in broadcast_and_verify](https://junglewise.ai/threats/mpp-vulnerable-to-gas-draining-with-low-gas-limit-9a9ae054)
- [ZenHive mpp input validation bypass in fee-payer cosigning](https://junglewise.ai/threats/mpp-vulnerable-to-gas-draining-with-no-limit-9bf9cd33)
- [ZenHive mpp authorization bypass in payment channel validation](https://junglewise.ai/threats/cve-2026-89420-improper-validation-of-specified-quantity-in-input-in-zenhive-mpp)
- [ZenHive mpp authentication bypass in subscription activation](https://junglewise.ai/threats/cve-2026-87119-authentication-bypass-by-capture-replay-in-zenhive-mpp-allows-an)
- [ZenHive mpp HTTP cache header override vulnerability](https://junglewise.ai/threats/cve-2026-89186-zenhive-mpp-http-cache-header-override-vulnerability)