CVE-2026-82751: ZenHive MPP Privilege Escalation Vulnerability

CVE-2026-82751 Overview

CVE-2026-82751 is an improper input validation flaw [CWE-1284] in ZenHive mpp, an Elixir library that sponsors Tempo payments on behalf of clients. The MPP.Methods.Tempo.FeePayerPolicy.measure/3 function in lib/mpp/methods/tempo/fee_payer_policy.ex fails to inspect the optional key_authorization field on a client-signed 0x76 envelope. An unauthenticated remote client can attach a signed key authorization to a normal sponsored payment. The sponsor then pays for provisioning a persistent access key with token spending limits on the client's own account. The issue affects mpp from version 0.2.0 before 0.16.1.

Critical Impact
Attackers can inflate the fee-payer's gas cost from about 46,587 gas to roughly 1,808,700 gas per sponsored request and receive a fully valid access key at zero cost.

Affected Products

ZenHive mpp versions 0.2.0 through 0.16.0
Elixir services running MPP.Methods.Tempo.FeePayerPolicy as a Tempo payment sponsor
Any deployment relying on lib/mpp/methods/tempo/fee_payer_policy.ex prior to the 0482572b commit

Discovery Timeline

2026-09-06 - CVE-2026-82751 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82751

Vulnerability Analysis

The mpp library sponsors Tempo payments by validating client-submitted transaction envelopes before signing them as fee-payer. When the server processes a sponsored request, MPP.Methods.Tempo.FeePayerPolicy.measure/3 enforces bounds on the gas fields, fee budget, validity window, and access list of the 0x76 envelope. The policy omits any check against the optional key_authorization field. A client can supply a fully signed key_authorization alongside a legitimate payment call. The Tempo runtime then provisions a new access key with configurable token spending limits and writes those entries to persistent storage. Every persistent storage write is billed as intrinsic gas to the sponsor, and the only ceiling is gas_limit.

Root Cause

The root cause is missing quantity validation on an optional envelope field. The sponsor policy assumes that bounding gas, fee budget, validity, and access-list size is sufficient to cap chargeable work. It does not enforce that key_authorization is absent or bounded, so the client controls the number of persistent state entries that the sponsor funds.

Attack Vector

An unauthenticated remote client crafts a Tempo payment request that carries both the ordinary call and a signed key_authorization for a new access key on the attacker's own account. The sponsor signs and submits the transaction, paying intrinsic gas for each key and token-limit write. At the reporter's default configuration of one key and three token limits, per-request sponsored cost rises from about 46,587 gas to about 1,808,700 gas. The attacker keeps a valid access key without funding it.

text

          {:ok, sender_signature} <- sign_keychain(base_fields, access_key, access_key_address, source_address),
          fields = base_fields ++ [sender_signature],
          {:ok, tx} <- deserialize(fields),
-         :ok <- validate_sponsor_policy(tx, config, sponsored?, now),
+         :ok <- validate_sponsor_policy(tx, config, sponsored?, now, authorization),
          {:ok, tx} <- maybe_cosign(tx, source_address, config) do
       {:ok, tx, hex(memo)}
     else

Source: GitHub Commit 0482572b. The patch threads the authorization value into validate_sponsor_policy/5 so the fee-payer policy can inspect and bound key_authorization before signing.

Detection Methods for CVE-2026-82751

Indicators of Compromise

Sponsored Tempo transactions with per-request intrinsic gas near or above 1,800,000 gas where prior baselines were near 46,587 gas.
0x76 envelopes submitted to the sponsor endpoint that carry a populated key_authorization field.
On-chain provisioning of new access keys with token spending limits on client accounts, funded by the sponsor address.

Detection Strategies

Parse sponsor request logs and alert when the decoded 0x76 envelope contains a non-empty key_authorization field.
Compare gas billed per sponsored payment against a rolling baseline and flag statistical outliers above the historical mean.
Correlate sponsor-funded transactions with subsequent access-key provisioning events on client accounts.

Monitoring Recommendations

Ingest mpp sponsor logs and Tempo chain telemetry into a centralized analytics store for outlier queries.
Track cumulative daily gas spent per sponsor address and alert on sudden step-changes.
Monitor for repeated sponsored requests from the same remote client that provision access keys.

How to Mitigate CVE-2026-82751

Immediate Actions Required

Upgrade mpp to version 0.16.1 or later on every host that acts as a Tempo fee-payer.
Rotate or throttle the sponsor's funding account until the upgrade is verified in production.
Audit recent sponsored transactions for unexpected key_authorization provisioning and revoke keys that were funded through this flaw.

Patch Information

The fix landed in commit 0482572b47e1ffe1537ab80ab613d47b92833c2d and ships in mpp0.16.1. It passes the client authorization value into validate_sponsor_policy/5 so the sponsor policy inspects and bounds key_authorization before signing. See the GitHub Security Advisory GHSA-rpwj-vrf7-4x36, the Erlef CVE-2026-82751 Details, and the OSV Vulnerability EEF-CVE-2026-82751 record for full advisory data.

Workarounds

Reject at the request handler any 0x76 envelope that contains a non-empty key_authorization field before it reaches the sponsor policy.
Lower the configured gas_limit ceiling on sponsored transactions to cap the maximum billable persistent writes per request.
Rate-limit sponsored payments per client identity to reduce cumulative gas exposure until patching completes.

bash

# Update mix.exs to pin the patched release, then fetch and compile
# {:mpp, "~> 0.16.1"}
mix deps.update mpp
mix deps.get
mix compile --force