CVE-2026-89186
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In ZenHive mpp before version 0.16.2, use of cache containing sensitive information allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential sets payment-receipt and cache-control: private, but a mounting application can override them, e.g., by setting cache-control: public, allowing a CDN or reverse proxy to store the paid response and serve it to unpaid clients. Additionally, non-2xx responses may still carry Payment-Receipt.
Risk Assessment
The organization may suffer financial losses because paid content can be served to non-paying clients via cache, and payment receipts may be issued for responses that delivered no resource.
Recommendation
Upgrade mpp to version 0.16.2 or later. Ensure that mounting applications do not override the cache-control header set by the library.
Other vulnerabilities in mpp
See all- CVE-2026-88255Medium
In ZenHive mpp before version 0.16.2, improper validation of unsafe equivalence in input allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot based on caller-supplied hex, not on a canonical form, allowing two different reserve keys for the same transaction (e.g., v=27 and v=0). As a result, both pass the reserve and reach the broadcast path, and a node may return a second valid Payment-Receipt for a single on-chain payment.
- CVE-2026-59695High
A vulnerability in the ZenHive mpp library allows an unauthenticated remote attacker to drain the fee-payer wallet in a single request by specifying an arbitrarily high gas price. The library does not validate the max_fee_per_gas and max_priority_fee_per_gas fields before co-signing the transaction, causing the server's wallet to be charged inflated costs.
- CVE-2026-59694High
A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to inflate the fee-payer's gas cost by adding a large number of fabricated EIP-2930 access list entries. The server co-signs the transaction without validating the list length or contents, leading to a multiple increase in gas costs.
- CVE-2026-59252High
A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to drain the fee-payer wallet by submitting EVM transactions with a deliberately low gas limit. The server co-signs and broadcasts the transaction, which fails due to out-of-gas, but the fee-payer wallet is charged for the burned gas while the attacker pays nothing. This leads to denial of service for legitimate clients as the fee-payer wallet runs out of funds.
Original NVD description (English source)
Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource. This issue affects mpp: from 0.1.0 before 0.16.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS