CVE-2026-45137High· 8.2▾ Twilight`Program<System>` accepts arbitrary executable programs
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
Affected versions of anchor-lang did not properly validate accounts declared
as Program<'info, System>. The generic Program<T> validation path used
Pubkey::default() as a sentinel to decide whether any executable program
should be accepted. Since the system program id is also the default pubkey,
Program<'info, System> was treated like the untyped Program<'info> case and
accepted any executable program account.
Programs commonly rely on Program<'info, System> to ensure that CPI calls and
instruction builders target the real Solana system program. With the faulty
validation, an attacker could supply another executable program where the system
program was expected, causing downstream logic to make false assumptions about
payments, account creation, or other system-program CPIs.
The issue was fixed in anchor-lang 1.0.2 by separating the typed
Program<T> validation path from the untyped Program<()> path, so
Program<'info, System> now checks the provided account key against the system
program id. Users should upgrade to anchor-lang 1.0.2 or later.
anchor-lang >= 1.0.0, < 1.0.2Upgrade to a patched release:
anchor-lang 1.0.2Connected by shared product, vendor, weakness, or advisory.