---
id: RUSTSEC-2026-0146
aliases:
  - GHSA-429q-fhh4-r6hj
title: '`InterfaceAccount` allows account substitution between unexpected types'
summary: '`InterfaceAccount` allows account substitution between unexpected types'
severity: none
vendor: anchor-lang
product: anchor-lang
ecosystem: rust
affected:
  - 'anchor-lang >= 1.0.0-rc.1, < 1.0.0-rc.2'
patched:
  - anchor-lang 1.0.0-rc.2
published: '2026-05-08'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:08.341270961Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0146'
references:
  - url: 'https://crates.io/crates/anchor-lang'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0146.html'
  - url: 'https://github.com/solana-foundation/anchor/pull/3837'
  - url: 'https://github.com/otter-sec/anchor/pull/3837'
  - url: 'https://github.com/otter-sec/anchor/pull/4139'
  - url: >-
      https://github.com/otter-sec/anchor/commit/26ef36968a62e28a1f028e7adae4806af30c747d
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.193Z'
---

## Overview

Affected versions of `anchor-lang` allowed `InterfaceAccount` to accept accounts
with an unexpected Anchor discriminator. A change to `InterfaceAccount` caused
checked deserialization to be bypassed for this account wrapper, so validation
proved only that the account owner matched one of the accepted interface owners.
It did not prove that the account data belonged to the expected account type.

Programs using `InterfaceAccount` rely on Anchor to enforce both owner and
account-type validation before the handler runs. With discriminator checking
disabled, an attacker could pass another account type owned by an accepted
program and have it deserialized through the expected interface wrapper. This
could bypass account-type assumptions made by the program and lead to incorrect
authorization or state handling.

The issue was fixed in `anchor-lang` 1.0.0-rc.2 by restoring checked
deserialization for `InterfaceAccount::try_from`, while keeping explicitly
unchecked behavior available only through the unchecked API. Users should
upgrade to `anchor-lang` 1.0.0-rc.2 or later.

## Affected packages

- `anchor-lang >= 1.0.0-rc.1, < 1.0.0-rc.2`

## Remediation

Upgrade to a patched release:

- `anchor-lang 1.0.0-rc.2`