CVE-2026-45057 Overview
CVE-2026-45057 affects the matrix-sdk-ui crate, which provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in versions prior to 0.17.0 fails to verify that a replacement event for an encrypted message is itself encrypted. A malicious homeserver administrator, or an actor with equivalent privileges, can exploit this gap to inject unencrypted replacement events that clients render as edits from a victim user. This enables message spoofing and impersonation in Matrix clients built on the affected crate. The issue is classified under [CWE-345: Insufficient Verification of Data Authenticity].
Critical Impact
A malicious homeserver operator can spoof edits to encrypted messages, making arbitrary content appear as if a victim user sent it.
Affected Products
- matrix-sdk-ui crate versions prior to 0.17.0
- Matrix clients built on matrix-rust-sdk that consume the matrix-sdk-ui timeline utilities
- Downstream Rust applications shipping vulnerable matrix-sdk 0.16.x releases
Discovery Timeline
- 2026-09-11 - CVE-2026-45057 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-45057
Vulnerability Analysis
The Matrix protocol supports message edits through replacement events that reference an original event by ID. When the original event is end-to-end encrypted, the Matrix specification requires the replacement event to also be encrypted so that clients can validate authenticity against the sender's Megolm session. The matrix-sdk-ui crate skipped this encryption check when applying edits to timeline items. As a result, the crate accepted a plaintext replacement event as a valid edit for an encrypted message. Clients then displayed the plaintext replacement content as if it had originated from the sender of the original encrypted event.
Root Cause
The root cause is missing validation logic in the timeline's edit application path. The code confirmed that a replacement event referenced an existing event and that sender identifiers matched, but it did not enforce that the replacement carried the same encryption properties as the target. This omission diverges from the algorithm for replacement events described in the Matrix specification and constitutes insufficient verification of data authenticity.
Attack Vector
Exploitation requires an attacker positioned as a homeserver administrator or with equivalent server-side write access to the room's event graph. The attacker injects a plaintext m.room.message event with a m.relates_to field of type m.replace targeting an encrypted event previously sent by the victim. Vulnerable clients accept the replacement and render the attacker-controlled content under the victim's display name. The attack does not require user interaction on the victim's endpoint, and the network attack surface is the federated Matrix protocol.
For technical details on the fix, see the matrix-rust-sdk pull request 6454 and the GHSA-h97m-27fx-42rx advisory.
Detection Methods for CVE-2026-45057
Indicators of Compromise
- Timeline events of type m.room.message that contain an m.relates_to block with rel_typem.replace referencing an event ID whose original type is m.room.encrypted.
- Replacement events sent by a homeserver-controlled or privileged account rather than by the account listed in the sender field of the original encrypted event.
- Log entries in Matrix client debug output showing edits applied to encrypted events without a corresponding decryption step.
Detection Strategies
- Audit room event graphs on trusted homeservers for plaintext replacement events targeting encrypted originals and flag any mismatch in encryption state between original and edit.
- Compare matrix-sdk and matrix-sdk-ui crate versions in software bills of materials against the fixed 0.17.0 release to identify vulnerable client builds.
- Track outbound network telemetry from developer and end-user endpoints for connections to untrusted Matrix homeservers running vulnerable client versions.
Monitoring Recommendations
- Monitor Rust dependency manifests (Cargo.toml, Cargo.lock) in code repositories for matrix-sdk-ui versions below 0.17.0.
- Enable server-side logging on self-hosted Synapse or Dendrite deployments to capture replacement events and their encryption metadata for forensic review.
- Alert on privileged administrator actions on homeservers that write directly to room state or event streams outside of normal client flows.
How to Mitigate CVE-2026-45057
Immediate Actions Required
- Upgrade all applications that depend on matrix-sdk-ui to version 0.17.0 or later and rebuild affected client binaries.
- Inventory internal and third-party Matrix clients to identify any still shipping matrix-sdk 0.16.x or earlier and prioritize their update.
- Communicate the spoofing risk to users of federated rooms hosted on untrusted homeservers until client updates are deployed.
Patch Information
The fix is included in matrix-sdk-ui 0.17.0, which aligns the edit validation logic with the Matrix specification's replacement event algorithm. Related release notes are published in the matrix-sdk-0.16.1 release page and the RustSec advisory RUSTSEC-2026-0158. Downstream maintainers should bump the dependency, run integration tests against encrypted rooms, and publish updated client binaries to users.
Workarounds
- No vendor-supplied workarounds are available; upgrading matrix-sdk-ui to 0.17.0 is required.
- As an interim risk-reduction measure, restrict client usage to homeservers under direct organizational control where administrator actions are logged and audited.
- Advise users to verify sensitive message content out-of-band, such as through device-verified direct sessions, until patched clients are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.