MultiversX multisig-improved: Authorization bypass allows fund transfers by Proposer
Summary
The multisig-improved reference implementation of the MultiversX on-chain multisig contract system fails to set the quorum for batch proposals. An account with the Proposer role can therefore propose and execute a batch action without any board member signature. An attacker may drain the full EGLD and ESDT balance of an affected contract in two transactions.
Affected
- MultiversX multisig-improved (repository mx-multisig-and-modules), affected commit 2e6dbea40f9b8ac165572a9efd4304804762a299
- Affected version range: Unknown.
Fixed in
Unknown.
Workaround
- No vendor mitigation found.
- Remove unneeded Proposer addresses from multisig contracts.
- Do not rely on a single Proposer for large transfers; require board quorum approvals and review contracts before moving funds.
Exploitation
- CISA SSVC (CERT/CC): Exploitation poc, Automatable yes, Technical Impact total.
- Public exploit status is conflicting: VulDB reports no exploit publicly available; the CISA ADP data suggests a proof of concept may exist. Unverified.
- Not listed in CISA KEV.
- An attacker needs a Proposer-role address on the target contract.
Our recommendation
- Check whether your organisation or its clients use MultiversX multisig contracts holding EGLD or ESDT.
- Review and reduce the Proposer and board member lists of each contract.
- Monitor contracts for transactions without matching board approvals.
- Ask MultiversX for the advisory and fix status before the next treasury action.
- Treat as high priority if such contracts exist, since on-chain losses are generally not recoverable.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gist: CVE-2026-106511 technical write-up gist.github.com
- MultiversX mx-multisig-and-modules repository github.com
- VulDB entry 414441 vuldb.com
- OpenCVE CVE-2026-106511 app.opencve.io
- HOL Guard CVE-2026-106511 hol.org
- Strix CVE-2026-106511 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:05.
Original description (NVD)
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.