Vulnerability HighRUSTSEC-2026-0144 · anchor-lang
RUSTSEC-2026-0144: `Program<System>` accepts arbitrary executable programs
Short answerA security vulnerability in the anchor-lang crate: `Program<System>` accepts arbitrary executable programs. High severity (CVSS 8.2). Fixed in 1.0.2: update to a fixed version.
| Crate | anchor-lang |
|---|---|
| Type | Vulnerability |
| Affected versions | From 1.0.0 before 1.0.2. |
| Fixed in | 1.0.2 |
| Severity | High, CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
| Published | 2026-05-07 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2026-45137, GHSA-c6rc-8jpp-2fgc |
What to do
- See which version you have:
cargo tree -i anchor-lang(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p anchor-lang. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleanchor-lang = "1.0.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of anchor-lang did not properly validate accounts declared as Program<'info, System>. The generic Program<T> validation path used Pubkey::default() as a sentinel to decide whether any executable program should be accepted. Since the system program id is also the default pubkey, Program<'info, System> was treated like the untyped Program<'info> case and accepted any executable program account.
Programs commonly rely on Program<'info, System> to ensure that CPI calls and instruction builders target the real Solana system program. With the faulty validation, an attacker could supply another executable program where the system program was expected, causing downstream logic to make false assumptions about payments, account creation, or other system-program CPIs.
The issue was fixed in anchor-lang 1.0.2 by separating the typed Program<T> validation path from the untyped Program<()> path, so Program<'info, System> now checks the provided account key against the system program id. Users should upgrade to anchor-lang 1.0.2 or later.
References
- Package: crates.io/crates/anchor-lang
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0144.html
- Web: github.com/solana-foundation/anchor/commit/3eb1fb0427d4fed0e944b627aef76db651a93aab
- Web: github.com/solana-foundation/anchor/releases/tag/v1.0.2
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for anchor-lang
Up next
Same crateanchor-lang: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?