How severe is GHSA-429q-fhh4-r6hj?

No CVSS score has been assigned to GHSA-429q-fhh4-r6hj yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-429q-fhh4-r6hj?

GHSA-429q-fhh4-r6hj affects the following packages: anchor-lang (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-429q-fhh4-r6hj?

Update anchor-lang to 1.0.0-rc.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-429q-fhh4-r6hj is resolved across your whole dependency graph.

How do I detect GHSA-429q-fhh4-r6hj in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for anchor-lang, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-429q-fhh4-r6hj if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-429q-fhh4-r6hj actively exploited in the wild?

No public exploit code has been indexed for GHSA-429q-fhh4-r6hj yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-429q-fhh4-r6hj published, and has it been updated?

GHSA-429q-fhh4-r6hj was published on May 13, 2026 and was last updated on May 19, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🦀 crates.io

Not in CISA KEV

GHSA-429q-fhh4-r6hj — anchor-lang

Fix: solana-foundation/anchor#3837

GHSA-429q-fhh4-r6hj is a security vulnerability in anchor-lang. A fix is available for anchor-lang — see the affected versions and patch details below.

Anchor: `InterfaceAccount` allows account substitution between unexpected types

Also known asRUSTSEC-2026-0146

Published

May 13, 2026

Updated

May 19, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of May 19, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🦀anchor-lang

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type.

The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details.

Patches

https://github.com/solana-foundation/anchor/pull/4139 patched the issue and was released in 1.0.0-rc.2. Users should upgrade to the latest released version of Anchor 1.0.

References

Bug landed in: https://github.com/solana-foundation/anchor/pull/3837 Bug fixed in: https://github.com/solana-foundation/anchor/pull/4139

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`anchor-lang`	≥ 1.0.0-rc.1&&< 1.0.0-rc.2	1.0.0-rc.2`cargo update -p anchor-lang --precise 1.0.0-rc.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for anchor-lang, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update anchor-lang to 1.0.0-rc.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-429q-fhh4-r6hj is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Any uses of `InterfaceAccount` allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type. The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details. ### Patches https://github.com/solana-foundation/anchor/pull/4139 patched the issue and was released in `1.0.0-rc.2`. Users should upgrade to the latest released version of Anchor 1.0. ### References Bug landed in: https://github.com/solana-foundation/anchor/pull/3

O3 Security · Impact-Aware SCA

Is GHSA-429q-fhh4-r6hj in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works