CVE-2026-41583

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.

• CWE-573

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jjVendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41576Brave CMS is an open-source CMS. Prior to commit 6c56603, th…7.1
• CVE-2026-41577authentik is an open-source identity provider. Prior to vers…7.5
• CVE-2026-41579runc is a CLI tool for spawning and running containers accor…3.3
• CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Ele…7.3
• CVE-2026-41580Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-41581Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-41584ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-41585ZEBRA is a Zcash node written entirely in Rust. From zebrad …6.5
• CVE-2026-41586Hyperledger Fabric is an enterprise-grade permissioned distr…9.3
• CVE-2026-41587CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …8.6
• CVE-2026-41588RELATE is a web-based courseware package. Prior to commit 2f…8.1
• CVE-2026-41589Wish is an SSH server with defaults and a collection of midd…9.6