CVE-2026-34068

OVERVIEW CVE-2026-34068 affects nimiq-transaction versions prior to 1.3.0, a Rust implementation component used in Nimiq's blockchain protocol. The vulnerability exists in the staking contract's handling of UpdateValidator transactions, which can accept new voting keys without requiring proof-of-knowledge validation. This omission bypasses critical security protections designed to prevent BLS rogue-key attacks when validator public keys are aggregated for consensus verification. SEVERITY The vulnerability has a CVSS score of 6.8 (Medium) with a network-based attack vector and high attack complexity. While an attacker could theoretically forge a quorum-looking macro block justification with a single malicious signature by introducing a rogue-key voting key into the validator set, practical exploitation is constrained by the requirement to predict the next epoch's validator set, which is determined through a verifiable random function. The integrity impact is high, but confidentiality and availability are not affected. The EPSS score of 0.00008 and Faucet Risk Score of 36 indicate relatively low real-world threat likelihood compared to other vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation, and the vulnerability is not listed on the CISA KEV catalog. No public exploit code is currently available. Community attention appears minimal, with the vulnerability classified as inactive on threat tracking lists. The patch is available in version 1.3.0 and above, with no known workarounds for affected versions.