CVE-2026-82750 ZenHive CVE debrief

Who should care

Defenders responsible for ZenHive mpp deployments, particularly those using sponsored payments, should assess exposure and prioritize verification and remediation efforts. They should review sponsored payment configurations to prevent similar gas cost inflation attacks and monitor for suspicious activity related to sponsored payments.

Why it matters

CVE-2026-82750 allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment, potentially leading to significant financial impacts and unauthorized use of sponsored payments.

• Potential for significant gas cost inflation
• Possible unauthorized use of sponsored payments for EIP-7702 account delegations
• Need for verification of affected versions and remediation efforts

Technical summary

The vulnerability is caused by improper validation of specified quantity in input in ZenHive mpp, which allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. This can lead to significant financial impacts and unauthorized use of sponsored payments. The vulnerability affects mpp versions from 0.2.0 before 0.16.1.

Defensive priority

Defenders should prioritize verifying and upgrading to mpp version 0.16.1 or later, and review sponsored payment configurations to prevent similar gas cost inflation attacks.

Recommended defensive actions

• Verify and upgrade to mpp version 0.16.1 or later
• Review sponsored payment configurations to prevent similar gas cost inflation attacks
• Monitor for suspicious activity related to sponsored payments
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source references provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. Defenders should verify the affected versions and review sponsored payment configurations to prevent similar gas cost inflation attacks. The CVE Program record and NVD detail page provide additional information on the vulnerability. The source references also provide additional context on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.