Critical vulnerability in `ismp-grandpa` <v15.0.1
Priority MEDIUM 46CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed hyperbridge (polytope-labs): 15.0.1ismp-grandpa (crates.io): 15.0.1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| polytope-labs | hyperbridge | before 15.0.1 | 15.0.1 | Patch available | CNA |
| — | ismp-grandpa (crates.io) | before 15.0.1 | 15.0.1 | Patch available | GHSA-wwx5-gpgr-vxr7 |
| — | grandpa-verifier-primitives (crates.io) | before 0.1.2 | 0.1.2 | Patch available | GHSA-wwx5-gpgr-vxr7 |
| — | grandpa-verifier (crates.io) | before 0.1.2 | 0.1.2 | Patch available | GHSA-wwx5-gpgr-vxr7 |
- hyperbridge Vendorpolytope-labs Affected before 15.0.1 Fixed in 15.0.1 Patch available CNA
- ismp-grandpa (crates.io) Vendor— Affected before 15.0.1 Fixed in 15.0.1 Patch available GHSA-wwx5-gpgr-vxr7
- grandpa-verifier-primitives (crates.io) Vendor— Affected before 0.1.2 Fixed in 0.1.2 Patch available GHSA-wwx5-gpgr-vxr7
- grandpa-verifier (crates.io) Vendor— Affected before 0.1.2 Fixed in 0.1.2 Patch available GHSA-wwx5-gpgr-vxr7
Remediation
- Fix · CNA hyperbridge (polytope-labs) Fixed in 15.0.1
- Fix · GHSA-wwx5-gpgr-vxr7 ismp-grandpa (crates.io) Fixed in 15.0.1 Advisory →
- Fix · GHSA-wwx5-gpgr-vxr7 grandpa-verifier-primitives (crates.io) Fixed in 0.1.2 Advisory →
- Fix · GHSA-wwx5-gpgr-vxr7 grandpa-verifier (crates.io) Fixed in 0.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24800
- 2026-10-03 Alias added: GHSA-wwx5-gpgr-vxr7
References
Other 6
- https://github.com/polytope-labs/hyperbridge/security/advisories/GHSA-wwx5-gpgr-vxr7
- https://github.com/polytope-labs/hyperbridge/pull/372/commits/f0e85db718f5165b06585a49b14a66f8ad643aea
- https://github.com/polytope-labs/ismp-substrate/pull/64/commits/5ca3351a19151f1a439c30d5cbdbfdc72a11f1a8#diff-3835cc24fb2011b3e8246036059acd8c2c2a9a869eedf7a210d18edb6543318dL262
- https://github.com/polytope-labs/ismp-substrate/pull/64/commits/04d5be207b082eb61d586d52e1685e2e060347e6#diff-4aedbca82d26bebc03f274e23fd5697c3346ffff54405c87af9018f3aef708b2R1-R160
- https://github.com/polytope-labs/ismp-substrate/pull/64/commits/b26894913b301061b07db61af841ca2586415f08#diff-493a6129d75fe31185e28695a4d2adc1582fe9df12462e380fe994f170fc1e70L159
- https://github.com/polytope-labs/hyperbridge
Sources
- CVE-2025-24800 · CVE Program
- CVE-2025-24800 · NVD
- FIRST EPSS
- GHSA-wwx5-gpgr-vxr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences