CVE-2026-39911: Hashgraph Guardian RCE Vulnerability

CVE-2026-39911 Overview

Hashgraph Guardian through version 3.5.0 contains a critical unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker. This flaw allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript expressions directly to the Node.js Function() constructor without proper isolation or sandboxing.

The vulnerability enables attackers to import native Node.js modules to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and ultimately forge valid authentication tokens for any user including administrators.

Critical Impact

Authenticated attackers can achieve full remote code execution, exfiltrate sensitive credentials including cryptographic keys, and forge administrator authentication tokens to completely compromise the Hashgraph Guardian instance.

Affected Products

• Hashgraph Guardian through version 3.5.0
• Custom Logic policy block worker component
• Deployments using Standard Registry user authentication

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39911 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39911

Vulnerability Analysis

This vulnerability stems from CWE-668 (Exposure of Resource to Wrong Sphere), where the Custom Logic policy block worker in Hashgraph Guardian fails to properly isolate user-supplied JavaScript code. When authenticated Standard Registry users submit JavaScript expressions through the policy block interface, these expressions are passed directly to the Node.js Function() constructor without any sandboxing or isolation mechanisms.

The lack of proper code isolation means that user-supplied code executes with the full privileges of the Node.js process, enabling access to the entire Node.js runtime environment including native modules, the filesystem, and process environment variables. This architectural flaw transforms what should be a limited scripting capability into a full remote code execution vector.

Root Cause

The root cause is the unsafe use of the JavaScript Function() constructor to evaluate user-provided code without implementing proper sandboxing. The Function() constructor creates a new function object from a string, but unlike sandboxed environments such as vm2 or isolated-vm, it does not restrict access to global objects, native modules, or the broader Node.js runtime. This allows malicious code to break out of the intended execution context and access sensitive resources.

Attack Vector

The attack is network-based and requires low privileges (Standard Registry user authentication). An attacker with valid credentials can craft malicious JavaScript payloads that:

1. Import native Node.js modules such as fs and child_process
2. Read arbitrary files from the container filesystem including configuration files and credentials
3. Access process.env to extract sensitive environment variables containing RSA private keys, JWT signing secrets, and API tokens
4. Use exfiltrated cryptographic keys to forge valid authentication tokens for any user, including administrators
5. Achieve persistent administrative access to the Hashgraph Guardian instance

The attack requires no user interaction and can be performed remotely over the network by any authenticated Standard Registry user. For detailed technical information, refer to the VulnCheck Security Advisory.

Detection Methods for CVE-2026-39911

Indicators of Compromise

• Unusual JavaScript code patterns in Custom Logic policy block submissions containing references to require(), process, fs, or child_process
• Access attempts to sensitive files such as /etc/passwd, configuration files, or credential stores from the Guardian container
• Unexpected outbound network connections from the Guardian service attempting data exfiltration
• Authentication token usage patterns indicating forged tokens or unauthorized administrator access

Detection Strategies

• Monitor Custom Logic policy block submissions for suspicious Node.js module imports and process access patterns
• Implement application-level logging for all JavaScript code execution within the policy block worker
• Deploy file integrity monitoring on the Guardian container to detect unauthorized file access
• Analyze authentication logs for anomalous token patterns or unexpected privilege escalation events

Monitoring Recommendations

• Enable verbose logging for the Custom Logic policy block worker component
• Monitor process environment variable access patterns within container workloads
• Implement network egress monitoring to detect credential exfiltration attempts
• Review Standard Registry user activities and policy block modifications regularly

How to Mitigate CVE-2026-39911

Immediate Actions Required

• Upgrade Hashgraph Guardian to a patched version as soon as available
• Audit all Standard Registry user accounts and remove unnecessary access privileges
• Review Custom Logic policy blocks for any suspicious or unauthorized JavaScript code
• Consider temporarily disabling the Custom Logic policy block feature until patching is complete
• Rotate all sensitive credentials including RSA private keys, JWT signing keys, and API tokens that may have been exposed

Patch Information

The fix for this vulnerability is tracked in GitHub Pull Request #5929. Organizations should monitor this pull request and apply the patch as soon as it is merged and released. The patch is expected to implement proper JavaScript sandboxing to isolate user-supplied code from the Node.js runtime environment.

For additional details on the vulnerability and remediation guidance, consult the VulnCheck Security Advisory.

Workarounds

• Restrict Standard Registry user access to only trusted personnel until the patch is applied
• Implement network segmentation to limit the Guardian service's access to sensitive internal resources
• Deploy Web Application Firewall (WAF) rules to filter potentially malicious JavaScript patterns in policy block submissions
• Monitor and alert on any Custom Logic policy block modifications in production environments