TI-2026-66744 Aliases GHSA-429q-fhh4-r6hj

Anchor: `InterfaceAccount` allows account substitution between unexpected types

LOW 38CWE-20Published 2026-05-13 · Updated 2026-05-19

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact Any uses of `InterfaceAccount` allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type. The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details. ### Patches https://github.com/solana-foundation/anchor/pull/4139 patched the issue and was released in `1.0.0-rc.2`. Users should upgrade to the latest released version of Anchor 1.0. ### References Bug landed in: https://github.com/solana-foundation/anchor/pull/3837 Bug fixed in: https://github.com/solana-foundation/anchor/pull/4139

Why it matters now

Fix Fixed anchor-lang (crates.io): 1.0.0-rc.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	anchor-lang (crates.io)	1.0.0-rc.1 to before 1.0.0-rc.2	1.0.0-rc.2	Patch available	GHSA-429q-fhh4-r6hj

anchor-lang (crates.io) Vendor— Affected 1.0.0-rc.1 to before 1.0.0-rc.2 Fixed in 1.0.0-rc.2 Patch available GHSA-429q-fhh4-r6hj

Remediation

Fix · GHSA-429q-fhh4-r6hj anchor-lang (crates.io) Fixed in 1.0.0-rc.2 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-429q-fhh4-r6hj

References

Other 7

Sources

GHSA-429q-fhh4-r6hj · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences