CVE-2026-46654 Overview
CVE-2026-46654 affects Plonky3, a toolkit for polynomial Interactive Oracle Proofs (PIOPs) used in zero-knowledge proof systems. The vulnerability allows an attacker controlling prover-side observations to craft distinct transcripts that produce identical Fiat-Shamir challenges. This breaks the binding property of the Fiat-Shamir transform, which is foundational to the soundness of non-interactive proofs built on Plonky3. The issue impacts versions prior to 0.4.3 and 0.5.3 and is classified under [CWE-345: Insufficient Verification of Data Authenticity]. Maintainers patched the flaw in releases 0.4.3 and 0.5.3.
Critical Impact
Attackers can forge proofs by producing colliding transcripts, undermining the integrity of any application relying on Plonky3 for cryptographic verification.
Affected Products
- Plonky3 versions prior to 0.4.3 (0.4.x branch)
- Plonky3 versions prior to 0.5.3 (0.5.x branch)
- Downstream zero-knowledge applications embedding vulnerable Plonky3 releases
Discovery Timeline
- 2026-06-10 - CVE-2026-46654 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-46654
Vulnerability Analysis
Plonky3 implements the Fiat-Shamir transform to convert interactive polynomial IOPs into non-interactive proofs. The transform derives verifier challenges from a hash of the protocol transcript. Binding requires that distinct transcripts always yield distinct challenges. In affected versions, the transcript absorption logic permits two structurally different prover-side observations to hash to the same challenge value. An attacker controlling what gets fed into the transcript can construct collisions and then choose a proof path that the verifier will accept.
This primarily affects integrity (VI:H) and downstream system integrity (SI:H). Confidentiality and availability are not impacted. Exploitation is network-reachable wherever proofs are accepted, but attack complexity is high because the adversary must control prover-side inputs and engineer transcript collisions.
Root Cause
The root cause is insufficient domain separation and ambiguous encoding when absorbing prover messages into the Fiat-Shamir transcript. Different sequences of field elements or commitments can serialize into the same byte stream before hashing. The challenge derivation therefore fails to uniquely bind to the full protocol state, violating the security assumption of the transform.
Attack Vector
An attacker who can influence prover-side observations crafts two transcripts that collide under the challenge derivation function. The attacker submits a proof tied to the alternative transcript. Because the verifier recomputes challenges from the same ambiguous absorption logic, it derives an identical challenge and accepts the forged proof. The verifier has no signal that the transcript was manipulated.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-vj64-rjf3-w3v7 for protocol-level details.
Detection Methods for CVE-2026-46654
Indicators of Compromise
- Acceptance of proofs whose transcripts contain duplicated or reorderable absorption segments
- Verification logs showing identical challenge values across structurally different proof submissions
- Dependency manifests (Cargo.toml, Cargo.lock) pinning Plonky3 versions below 0.4.3 or 0.5.3
Detection Strategies
- Inventory all Rust workspaces and build artifacts that depend on the plonky3 crate and compare resolved versions against the patched releases.
- Audit verifier logs for anomalous proof acceptance rates or repeated challenge values across distinct submissions.
- Add CI checks that fail builds when vulnerable Plonky3 versions are resolved transitively.
Monitoring Recommendations
- Instrument verifier services to record transcript hashes and derived challenges for offline correlation.
- Alert on rejected-then-accepted proof pairs originating from the same prover identity within short time windows.
- Track upstream Plonky3 releases and advisories through the GitHub Security Advisory feed.
How to Mitigate CVE-2026-46654
Immediate Actions Required
- Upgrade Plonky3 to version 0.4.3 if running the 0.4.x branch, or to 0.5.3 if running the 0.5.x branch.
- Rebuild and redeploy all downstream binaries and zero-knowledge services that link against the vulnerable crate.
- Revoke trust in proofs produced or verified by infrastructure running unpatched Plonky3 during the exposure window.
Patch Information
The Plonky3 maintainers patched the Fiat-Shamir binding flaw in releases 0.4.3 and 0.5.3. The fix tightens transcript absorption so that distinct prover observations produce distinct challenges. Refer to the Plonky3 GitHub Security Advisory for the full advisory and commit references.
Workarounds
- No supported workaround exists; the fix requires upgrading to a patched release.
- Operators who cannot upgrade immediately should restrict prover access to trusted parties and increase verifier-side audit logging until patching completes.
# Update the Plonky3 dependency in Cargo.toml to a patched release
# Then refresh the lockfile and rebuild
cargo update -p plonky3
cargo build --release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
