https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:25:44.044432+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-31020 CVE-2022-31020 — Remote code execution in Indy's NODE_UPGRADE transaction 2026-10-03T19:25:44.046164+00:00

Affected: hyperledger indy-node

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.

 https://cve.radiocsirt.org/vuln/ghsa-r6v9-p59m-gj2p GHSA-r6v9-p59m-gj2p — Indy's NODE_UPGRADE transaction vulnerable to remote code execution 2026-10-03T19:25:44.046218+00:00

Affected: PyPI: indy-node

### Impact

The `pool-upgrade` request handler in Indy-Node `<=1.12.4` allows an improperly authenticated attacker to remotely execute code on nodes within the network.

Network operators are strongly encouraged to upgrade to the latest Indy-Node release `>=1.12.5` as soon as possible.

### Patches

The `pool-upgrade` request handler in Indy-Node `>=1.12.5` has been updated to properly authenticate `pool-upgrade` transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution.

### Mitigations

Network operators are strongly encouraged to upgrade to the latest Indy-Node release `>=1.12.5` as soon as possible.

### Acknowledgements Thank you to @shakreiner at CyberArk Labs for finding and responsibly disclosing this issue.