Quick answers
- Is CVE-2026-82750 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82750 being exploited in the wild.
- How severe is CVE-2026-82750?
- Informational severity, with a CVSS score of 0, published 6 September 2026.
- Which products and versions are affected?
- ZenHive Mpp 0.2.0 through 0.16.0.
- Is there a fix for CVE-2026-82750?
- A patch was published on 0.16.1: Fix available in version 0.16.1 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82750 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82750?
- Check whether you run ZenHive Mpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an improper input validation flaw in the fee_payer_policy.ex module. When validating 0x76 envelope transactions, the server bounds gas fields, fee budgets, and validity windows, but fails to validate the aa_authorization_list field. This list contains EIP-7702 account delegations that incur intrinsic gas charges before the payment executes. An unauthenticated remote client can attach arbitrary delegations from throwaway keys to force the sponsor to pay for them; at typical settings (7 entries), this inflates costs from ~46,575 gas to ~1.88M gas. Additionally, each delegation is applied as a persistent set-code operation, allowing the client to upgrade its own accounts at the sponsor's expense. The issue affects mpp versions 0.2.0 through 0.16.0; a patch is available in 0.16.1+.
Affected products
- ZenHive mpp 0.2.0 through 0.16.0
Timeline
- 2026-09-06: disclosed
- 0.16.1: patched: Fix available in version 0.16.1 and later