CVE-2026-82750: ZenHive MPP Privilege Escalation Vulnerability

CVE-2026-82750 Overview

CVE-2026-82750 is an input validation flaw in ZenHive mpp, an Elixir library that sponsors Tempo payments on EIP-7702-capable networks. The fee-payer policy in MPP.Methods.Tempo.FeePayerPolicy.measure/3 bounds most fields of the client-signed 0x76 envelope but ignores the aa_authorization_list. An unauthenticated remote client can attach arbitrary signed delegations, forcing the sponsor to pay intrinsic gas for each entry and to install set-code delegations on accounts of the client's choosing. The issue affects mpp versions 0.2.0 through 0.16.0 and is classified under CWE-1284: Improper Validation of Specified Quantity in Input.

Critical Impact
A remote unauthenticated client can multiply the sponsor's per-payment gas cost roughly 40x and cause the sponsor to fund persistent EIP-7702 account delegations chosen by the attacker.

Affected Products

ZenHive mpp version 0.2.0
ZenHive mpp versions between 0.2.0 and 0.16.1
Fixed in ZenHive mpp version 0.16.1

Discovery Timeline

2026-09-06 - CVE-2026-82750 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82750

Vulnerability Analysis

ZenHive mpp implements a sponsored-payment flow in which a fee-payer signs and submits a transaction on behalf of a client. The client provides a signed 0x76 envelope describing the payment, and the sponsor validates it against a policy before broadcasting. The policy is expected to constrain every cost-relevant field so a malicious client cannot drain the sponsor's balance.

The validator inspects the gas fields, fee budget, validity window, and access list, but never inspects aa_authorization_list. That field carries EIP-7702 delegations, each of which is billed as intrinsic gas and each of which installs persistent set-code delegations when included in a transaction. Because the sponsor pays intrinsic gas and the delegations are applied against accounts specified by the attacker, the client externalizes both financial cost and on-chain state changes to the sponsor.

Root Cause

The missing check lives in MPP.Methods.Tempo.FeePayerPolicy.measure/3 inside lib/mpp/methods/tempo/fee_payer_policy.ex. The function reads bounded fields from the envelope but never reaches the aa_authorization_list, so any list length the client supplies passes validation as long as the totals stay under the default gas_limit ceiling.

Attack Vector

An unauthenticated remote client submits a signed Tempo payment envelope containing a populated aa_authorization_list. With the reporter's default of seven entries, the sponsored intrinsic gas rises from roughly 46,575 to roughly 1,884,087 gas per payment. Each entry additionally installs a persistent set-code delegation on the authority address that signed it, letting an attacker upgrade throwaway or attacker-controlled accounts to delegated code at the sponsor's expense.

text

          {:ok, sender_signature} <- sign_keychain(base_fields, access_key, access_key_address, source_address),
          fields = base_fields ++ [sender_signature],
          {:ok, tx} <- deserialize(fields),
-         :ok <- validate_sponsor_policy(tx, config, sponsored?, now),
+         :ok <- validate_sponsor_policy(tx, config, sponsored?, now, authorization),
          {:ok, tx} <- maybe_cosign(tx, source_address, config) do
       {:ok, tx, hex(memo)}
     else

Source: GitHub Commit 0482572b. The fix threads the authorization list into validate_sponsor_policy/5 so the fee-payer policy can bound its size before the payment is signed and broadcast.

Detection Methods for CVE-2026-82750

Indicators of Compromise

Sponsored transactions from an mpp fee-payer whose intrinsic gas consumption significantly exceeds the baseline for a standard Tempo payment.
Client 0x76 envelopes carrying a non-empty aa_authorization_list when the sponsor's business logic does not require delegations.
Unexpected EIP-7702 set-code delegations installed on accounts unaffiliated with the sponsor.

Detection Strategies

Instrument the fee-payer to log aa_authorization_list length and the authority addresses for every envelope processed by MPP.Methods.Tempo.FeePayerPolicy.measure/3.
Alert on any sponsored payment whose measured gas exceeds a hard threshold derived from expected payment shapes.
Correlate sponsor spend against on-chain delegation events using an EPSS score of 0.329% as a low-priority prioritization input.

Monitoring Recommendations

Track the running dependency version of mpp in build manifests and alert on any deployment still pinned below 0.16.1.
Monitor sponsor wallet balance decay against payment volume to surface gas amplification early.
Ingest chain-level set-code delegation events into the SIEM and pivot on sponsor-funded transactions.

How to Mitigate CVE-2026-82750

Immediate Actions Required

Upgrade mpp to version 0.16.1 or later in every service that sponsors Tempo payments.
Rotate any fee-payer keys that processed sponsored payments containing non-empty aa_authorization_list values.
Audit recent sponsored transactions for unexpected EIP-7702 delegations and revoke or replace affected delegated code where policy allows.

Patch Information

The upstream fix is commit 0482572b, released in mpp0.16.1. It passes the client authorization list into validate_sponsor_policy/5 so the fee-payer policy bounds authorization-list and key-authorization envelope fields. See the GitHub Security Advisory GHSA-5qrp-r24c-w6jr, the CNA advisory from EEF, and the OSV record EEF-CVE-2026-82750 for full metadata.

Workarounds

Reject sponsored envelopes whose aa_authorization_list is non-empty at an upstream proxy until the patched version is deployed.
Lower the sponsor gas_limit ceiling to the minimum required for a single Tempo payment without delegations.
Constrain sponsor eligibility to authenticated clients or allow-listed sender addresses while remediation is in progress.

bash

# Update mpp in mix.exs and rebuild the release
# {:mpp, "~> 0.16.1"}
mix deps.update mpp
mix deps.get
mix compile --force