Read the docs
TI-2022-13065 Aliases CVE-2022-31020GHSA-r6v9-p59m-gj2p

Remote code execution in Indy's NODE_UPGRADE transaction

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02308 83rd percentileScored 2026-11-07
Fix Fixed indy-node (PyPI): 1.12.5rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperledgerindy-nodeup to 1.12.4—No fix listedCNA
—indy-node (PyPI)before 1.12.5rc11.12.5rc1Patch availableGHSA-r6v9-p59m-gj2p
  • indy-node Vendorhyperledger Affected up to 1.12.4 Fixed in — No fix listed CNA
  • indy-node (PyPI) Vendor— Affected before 1.12.5rc1 Fixed in 1.12.5rc1 Patch available GHSA-r6v9-p59m-gj2p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:indy-node:*:*:*:*:*:*:*:*up to 1.12.4Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:indy-node:*:*:*:*:*:*:*:* Versions up to 1.12.4 Vulnerable ·backstage

Remediation

  • Fix · GHSA-r6v9-p59m-gj2p indy-node (PyPI) Fixed in 1.12.5rc1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31020
  2. 2026-10-03 Alias added: GHSA-r6v9-p59m-gj2p

References

Patch 1

Advisory 3

Other 2

  • TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
  • TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
  • TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
  • TI-2022-16450 Incorrect Conversion between Numeric Types in Besu Ethereum Client CVSS 3.1CRITICAL 9.1
  • TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
  • TI-2022-13165 Improper Input Validation in fabric hyperledger CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences