Anchor: `InterfaceAccount` allows account substitution between unexpected types
Anchor: `InterfaceAccount` allows account substitution between unexpected types. Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type.
Vuln-watch · relayed from the GitHub Advisory Database; see Source & attribution below
Summary
Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type.
Affected
- anchor-lang (rust) = 1.0.0-rc.1 — fixed in 1.0.0-rc.2
Severity
High (CVSS 8.7), as rated by the upstream advisory.
Recommended actions
- Upgrade anchor-lang to 1.0.0-rc.2 or later
Source & attribution
This 0xCERT advisory summarises GHSA-429q-fhh4-r6hj from the GitHub Advisory Database, credited upstream to acheroncrypto: https://github.com/advisories/GHSA-429q-fhh4-r6hj. Details may change; refer to the original source for the authoritative record.
References
- https://github.com/advisories/GHSA-429q-fhh4-r6hj
- https://github.com/solana-foundation/anchor/security/advisories/GHSA-429q-fhh4-r6hj
- https://github.com/solana-foundation/anchor/pull/3837
- https://github.com/solana-foundation/anchor/pull/4139
- https://github.com/solana-foundation/anchor/commit/26ef36968a62e28a1f028e7adae4806af30c747d
- https://github.com/otter-sec/anchor/security/advisories/GHSA-429q-fhh4-r6hj
- https://rustsec.org/advisories/RUSTSEC-2026-0146.html
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-05-13 · last updated 2026-10-08
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0198/signed.txt | gpg --verify